Overview

overview

7

Static

static

3

9faf8c37b6...06.exe

windows10-2004-x64

7

9faf8c37b6...06.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    112s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 14:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9faf8c37b6e6d278e458cce9ce7ceb609a8eff0580bcdb24190e584c00fa3406.exe
  • Size 1.6MB
  • Sample260528-rbb9psbs2z
  • SHA256 9faf8c37b6e6d278e458cce9ce7ceb609a8eff0580bcdb24190e584c00fa3406
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9faf8c37b6e6d278e458cce9ce7ceb609a8eff0580bcdb24190e584c00fa3406.exe
    "C:\Users\Admin\AppData\Local\Temp\9faf8c37b6e6d278e458cce9ce7ceb609a8eff0580bcdb24190e584c00fa3406.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Local\Temp\5032X.exe
      "C:\Users\Admin\AppData\Local\Temp\5032X.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Users\Admin\AppData\Local\Temp\5H0M2.exe
        "C:\Users\Admin\AppData\Local\Temp\5H0M2.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\AppData\Local\Temp\PNOS9.exe
          "C:\Users\Admin\AppData\Local\Temp\PNOS9.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5016
          • C:\Users\Admin\AppData\Local\Temp\43S61.exe
            "C:\Users\Admin\AppData\Local\Temp\43S61.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2120
            • C:\Users\Admin\AppData\Local\Temp\D7C9F.exe
              "C:\Users\Admin\AppData\Local\Temp\D7C9F.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4984
              • C:\Users\Admin\AppData\Local\Temp\C14QP.exe
                "C:\Users\Admin\AppData\Local\Temp\C14QP.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2876
                • C:\Users\Admin\AppData\Local\Temp\Z41A4.exe
                  "C:\Users\Admin\AppData\Local\Temp\Z41A4.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:116
                  • C:\Users\Admin\AppData\Local\Temp\9I3K9.exe
                    "C:\Users\Admin\AppData\Local\Temp\9I3K9.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1712
                    • C:\Users\Admin\AppData\Local\Temp\G61UZ.exe
                      "C:\Users\Admin\AppData\Local\Temp\G61UZ.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:2180
                      • C:\Users\Admin\AppData\Local\Temp\095W8.exe
                        "C:\Users\Admin\AppData\Local\Temp\095W8.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3756
                        • C:\Users\Admin\AppData\Local\Temp\Q1AHM.exe
                          "C:\Users\Admin\AppData\Local\Temp\Q1AHM.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3808
                          • C:\Users\Admin\AppData\Local\Temp\8O8CF.exe
                            "C:\Users\Admin\AppData\Local\Temp\8O8CF.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2508
                            • C:\Users\Admin\AppData\Local\Temp\O11G8.exe
                              "C:\Users\Admin\AppData\Local\Temp\O11G8.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:2016
                              • C:\Users\Admin\AppData\Local\Temp\X6BB6.exe
                                "C:\Users\Admin\AppData\Local\Temp\X6BB6.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:4140
                                • C:\Users\Admin\AppData\Local\Temp\Z540X.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Z540X.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3712
                                  • C:\Users\Admin\AppData\Local\Temp\69NI9.exe
                                    "C:\Users\Admin\AppData\Local\Temp\69NI9.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3068
                                    • C:\Users\Admin\AppData\Local\Temp\55XTO.exe
                                      "C:\Users\Admin\AppData\Local\Temp\55XTO.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:2176
                                      • C:\Users\Admin\AppData\Local\Temp\WM7EJ.exe
                                        "C:\Users\Admin\AppData\Local\Temp\WM7EJ.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:220
                                        • C:\Users\Admin\AppData\Local\Temp\VQEMS.exe
                                          "C:\Users\Admin\AppData\Local\Temp\VQEMS.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4776
                                          • C:\Users\Admin\AppData\Local\Temp\R03I1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\R03I1.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:4888
                                            • C:\Users\Admin\AppData\Local\Temp\6RC9T.exe
                                              "C:\Users\Admin\AppData\Local\Temp\6RC9T.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:1000
                                              • C:\Users\Admin\AppData\Local\Temp\P1L4S.exe
                                                "C:\Users\Admin\AppData\Local\Temp\P1L4S.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:4708
                                                • C:\Users\Admin\AppData\Local\Temp\1F5CE.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1F5CE.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2140
                                                  • C:\Users\Admin\AppData\Local\Temp\JC1CH.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\JC1CH.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4564
                                                    • C:\Users\Admin\AppData\Local\Temp\K561R.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\K561R.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4936
                                                      • C:\Users\Admin\AppData\Local\Temp\N5066.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\N5066.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1400
                                                        • C:\Users\Admin\AppData\Local\Temp\OGO0Z.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\OGO0Z.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4168
                                                          • C:\Users\Admin\AppData\Local\Temp\52V48.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\52V48.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2224
                                                            • C:\Users\Admin\AppData\Local\Temp\7Q94U.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\7Q94U.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1100
                                                              • C:\Users\Admin\AppData\Local\Temp\1ZTLY.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\1ZTLY.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3776
                                                                • C:\Users\Admin\AppData\Local\Temp\37W18.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\37W18.exe"
                                                                  32⤵
                                                                  • Checks computer location settings
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3408
                                                                  • C:\Users\Admin\AppData\Local\Temp\L8458.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\L8458.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4472
                                                                    • C:\Users\Admin\AppData\Local\Temp\PBYU5.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\PBYU5.exe"
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1856
                                                                      • C:\Users\Admin\AppData\Local\Temp\90482.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\90482.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4344
                                                                        • C:\Users\Admin\AppData\Local\Temp\C7464.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\C7464.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2236
                                                                          • C:\Users\Admin\AppData\Local\Temp\58Y42.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\58Y42.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4044
                                                                            • C:\Users\Admin\AppData\Local\Temp\87IW2.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\87IW2.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1220
                                                                              • C:\Users\Admin\AppData\Local\Temp\NPB0H.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\NPB0H.exe"
                                                                                39⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4032
                                                                                • C:\Users\Admin\AppData\Local\Temp\54I47.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\54I47.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1104
                                                                                  • C:\Users\Admin\AppData\Local\Temp\IRS4L.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\IRS4L.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1892
                                                                                    • C:\Users\Admin\AppData\Local\Temp\LLF0M.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\LLF0M.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3328
                                                                                      • C:\Users\Admin\AppData\Local\Temp\MT0O7.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\MT0O7.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3908
                                                                                        • C:\Users\Admin\AppData\Local\Temp\98FT8.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\98FT8.exe"
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:980
                                                                                          • C:\Users\Admin\AppData\Local\Temp\07P0R.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\07P0R.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1088
                                                                                            • C:\Users\Admin\AppData\Local\Temp\44450.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\44450.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3420
                                                                                              • C:\Users\Admin\AppData\Local\Temp\88KKQ.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\88KKQ.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2396
                                                                                                • C:\Users\Admin\AppData\Local\Temp\8T15F.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8T15F.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1572
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9Q395.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9Q395.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2352
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5L01A.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5L01A.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4584
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\620F0.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\620F0.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2700
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\329V1.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\329V1.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5000
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\M56W4.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\M56W4.exe"
                                                                                                            53⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1772
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N2661.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\N2661.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2068
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5082X.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5082X.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5032
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8FAQB.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8FAQB.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1020
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WQ22G.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\WQ22G.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3836
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\848G3.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\848G3.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2216
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3LJO1.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3LJO1.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2444
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\78I0U.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\78I0U.exe"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5112
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\HDQR0.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\HDQR0.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4976
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\24630.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\24630.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:3136
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OENHV.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\OENHV.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:396
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\0BN4L.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\0BN4L.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:4396
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\86XK5.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\86XK5.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2292
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\U5I9V.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\U5I9V.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:384
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2R7WW.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2R7WW.exe"
                                                                                                                                        67⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2676
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\96QVA.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\96QVA.exe"
                                                                                                                                          68⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4724
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TB5D3.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TB5D3.exe"
                                                                                                                                            69⤵
                                                                                                                                              PID:1832
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4EHL5.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4EHL5.exe"
                                                                                                                                                70⤵
                                                                                                                                                  PID:4132
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4M6I7.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4M6I7.exe"
                                                                                                                                                    71⤵
                                                                                                                                                      PID:1756
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\W5UP3.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\W5UP3.exe"
                                                                                                                                                        72⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        PID:4300
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1G2RR.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1G2RR.exe"
                                                                                                                                                          73⤵
                                                                                                                                                            PID:3020
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8SAQC.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8SAQC.exe"
                                                                                                                                                              74⤵
                                                                                                                                                                PID:2736
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Z342Y.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Z342Y.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                    PID:4172
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\541US.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\541US.exe"
                                                                                                                                                                      76⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4964
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\V14MT.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\V14MT.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                          PID:1640
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\TP3FR.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\TP3FR.exe"
                                                                                                                                                                            78⤵
                                                                                                                                                                              PID:5004
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\30WOD.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\30WOD.exe"
                                                                                                                                                                                79⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:3104
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\91BUF.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\91BUF.exe"
                                                                                                                                                                                  80⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  PID:1060
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\G3T8E.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\G3T8E.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4612
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B1R5H.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\B1R5H.exe"
                                                                                                                                                                                      82⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      PID:4412
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\FUY96.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\FUY96.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:2480
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\F8WPS.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\F8WPS.exe"
                                                                                                                                                                                          84⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:3728
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\75132.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\75132.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:3968
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\01JL4.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\01JL4.exe"
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                              PID:4560
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\692ZA.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\692ZA.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                PID:2280
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3D253.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3D253.exe"
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3956
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\744K8.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\744K8.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    PID:676
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AW7VD.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\AW7VD.exe"
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      PID:2136
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9F583.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9F583.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:4948
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\R4I47.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\R4I47.exe"
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                            PID:3288
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KN0E3.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KN0E3.exe"
                                                                                                                                                                                                              93⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\BYU31.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\BYU31.exe"
                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                PID:4852
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\70077.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\70077.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3504
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6P8V4.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6P8V4.exe"
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4ZK02.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\4ZK02.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        PID:1236
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\09081.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\09081.exe"
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:460
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\H4D4P.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\H4D4P.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                              PID:3932
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7J739.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7J739.exe"
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                  PID:5068
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\T3A31.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\T3A31.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4996
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P5K6O.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P5K6O.exe"
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IF5AM.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\IF5AM.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9UP56.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9UP56.exe"
                                                                                                                                                                                                                                            104⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:4524
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1P2WU.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1P2WU.exe"
                                                                                                                                                                                                                                              105⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4788
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\L23I2.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\L23I2.exe"
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:176
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\U2P06.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\U2P06.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2416
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IA002.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\IA002.exe"
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:4960
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7HJRB.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7HJRB.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                        PID:4720
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9B5N0.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9B5N0.exe"
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:5028
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\XJ425.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\XJ425.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                              PID:1440
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2480X.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2480X.exe"
                                                                                                                                                                                                                                                                112⤵
                                                                                                                                                                                                                                                                  PID:4624
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\T02HB.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\T02HB.exe"
                                                                                                                                                                                                                                                                    113⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\YD8J7.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\YD8J7.exe"
                                                                                                                                                                                                                                                                      114⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4952
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\A7867.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\A7867.exe"
                                                                                                                                                                                                                                                                        115⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WW253.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\WW253.exe"
                                                                                                                                                                                                                                                                          116⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1264
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\F78DE.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\F78DE.exe"
                                                                                                                                                                                                                                                                            117⤵
                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                            PID:1932
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\O9074.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\O9074.exe"
                                                                                                                                                                                                                                                                              118⤵
                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:1300
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TW0H6.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TW0H6.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                  PID:3192
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\922WN.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\922WN.exe"
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\32YV7.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\32YV7.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3364
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\13A8V.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\13A8V.exe"
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:3696
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6FLN8.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\6FLN8.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4880
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\H9H5H.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\H9H5H.exe"
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:1224
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\M182V.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\M182V.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                  PID:2024
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\I1268.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\I1268.exe"
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\95G6L.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\95G6L.exe"
                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                      PID:1500
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9268W.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9268W.exe"
                                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5S10I.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5S10I.exe"
                                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1E5HG.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1E5HG.exe"
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4124
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3VNF5.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\3VNF5.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\KWBU0.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\KWBU0.exe"
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:3496
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6B6G6.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6B6G6.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                    PID:2468
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\21R16.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\21R16.exe"
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                      PID:4012
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\64Q91.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\64Q91.exe"
                                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        PID:3644
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\96J0Q.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\96J0Q.exe"
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:2604
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\04NBC.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\04NBC.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                              PID:2668
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\55HX2.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\55HX2.exe"
                                                                                                                                                                                                                                                                                                                                138⤵
                                                                                                                                                                                                                                                                                                                                  PID:3520
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\085N3.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\085N3.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\T723O.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\T723O.exe"
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:3464
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\48P36.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\48P36.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                            PID:3848
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BU7G0.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BU7G0.exe"
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                                PID:2712
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\56OT8.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\56OT8.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                  PID:2392
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2GM4D.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2GM4D.exe"
                                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4532
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\F08Z3.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\F08Z3.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\O0791.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\O0791.exe"
                                                                                                                                                                                                                                                                                                                                                          146⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          PID:1672
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\271B6.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\271B6.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1676
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ZF11V.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\ZF11V.exe"
                                                                                                                                                                                                                                                                                                                                                                148⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4100
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\91CXE.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\91CXE.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:516
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\M4MG8.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\M4MG8.exe"
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                      PID:3856
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\AL977.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\AL977.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4K5L6.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4K5L6.exe"
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\9D64B.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\9D64B.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7C63G.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7C63G.exe"
                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\82MH8.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\82MH8.exe"
                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5008
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N5LA3.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\N5LA3.exe"
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5072
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\CZBR6.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\CZBR6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\743S8.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\743S8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6988E.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6988E.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\AK943.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\AK943.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:440
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Y9M55.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Y9M55.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IN44Q.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\IN44Q.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6D90L.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6D90L.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RUWK5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RUWK5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\W5T7X.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\W5T7X.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RSX85.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RSX85.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1860
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\N8757.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\N8757.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5MT95.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5MT95.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4732
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5087N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5087N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OZ166.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\OZ166.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2XXFT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2XXFT.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4L1WP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4L1WP.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\GQ6YS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\GQ6YS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\UI580.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\UI580.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\6TE8G.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\6TE8G.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\8VAT0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\8VAT0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\03YLE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\03YLE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9C92O.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9C92O.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0B8Y3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0B8Y3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\MUIKF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\MUIKF.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\N09C9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\N09C9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\45L44.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\45L44.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\115MW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\115MW.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\O6S0T.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\O6S0T.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\PAZX0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\PAZX0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42RD5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\42RD5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\888CE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\888CE.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9X0X5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9X0X5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\DZ4Q6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\DZ4Q6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R5J49.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\R5J49.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5096

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                095W8.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\095W8.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 94f74eaae5e077733cb416b725ab5e96d456fcad0bb46747932141368d08088b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                1F5CE.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1F5CE.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 d0501f30949d20dff52633b567d23cc640044f7dc4083163a4b43c78423441ce
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                1ZTLY.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1ZTLY.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 8580f73f78c30b22821d5051cdb601a5d513cf9e0b6f279d332eb663ea2a6072
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                37W18.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\37W18.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 a60f19012774c9a00c3286610ec87e91cdeb3a8fba7a18727d4ca66afaf53363
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                43S61.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\43S61.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 6e7a01ee6dce8ecc9f145f5783fe06f2208aa1214f6075daaa5afde9a5f9d22f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                5032X.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\5032X.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 92595a736e954def83f952d1bc389832e4bd375adb5e0b1405e4df9f05393ba0
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                52V48.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\52V48.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 473535a8b6b8507c29127db7c4b487f80dca5580fe20b5b0da2a0b0005ed575f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                55XTO.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\55XTO.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 9dbcd2d3f4fa58880e843816bd1825723cff0fd6a807426e17801e7a96555b87
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                5H0M2.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\5H0M2.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 cc82c3f93ba157df9ceea39d5eaeb04e10b14680ab9b4911c1c03219d66a27e4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                69NI9.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\69NI9.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 c90da650a4d8ebaa4589d0e4a0f3b4a4c9593e8e0ee6d1599466b0bab3c8d709
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                6RC9T.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6RC9T.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 297d4241ab5eec43ace46a16b7c90cf8aaff100355368f0539824845be83637c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                7Q94U.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7Q94U.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 09caf232adf1af68de10bfd9e1ea7d5b5cbd3f50f8137c4a35bd0613fbf454a9
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                8O8CF.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8O8CF.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 b45e819ea5846f2b7522295e459116401490a41ed6e1e22a2b62e80371269950
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                9I3K9.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\9I3K9.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 405d475bd46fcb184c80ab9b15874c9e034bd486d03764ca59b61bb3d1070f92
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                C14QP.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\C14QP.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 e33db19f462c6106d96ef642b0038b8474357e0f35d6b191f0477a2987115715
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                D7C9F.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\D7C9F.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 455a5dbd70948e13b4c21da23963b0302ebe5773da8b23b7df08cc71f643bbd3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                G61UZ.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\G61UZ.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 9333fbc6bc524710795202f42bce3bd47179252cca14e38299f8420784e8e2d3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                JC1CH.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\JC1CH.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 d9d1180c44f6b3320749fe6cb6737813e32af69c3c4bc2d747ccc57dda0911b6
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                K561R.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\K561R.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 86b12cc6c51c61141faad773814dc2bb10ff60fdc506ea0d37dd688e2a1e30e4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                L8458.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\L8458.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 05b19a4a16fed6e6e7abd73ec5bcf60f13ab6933cd53915f9e556936046beefc
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                N5066.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\N5066.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 2a8afc99df112a649a115230ee8a12da004b5467b70bab813b402eb316f000cd
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                O11G8.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\O11G8.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 550a2602669b214e05689162e6707a23af8991965fa86f91dfa74bb6d9e2245f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                OGO0Z.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OGO0Z.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 26ab8c6fb501bfd6ea389bf79a0d33d301d00aeec7274ab7ff4b9d60a0a83881
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                P1L4S.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\P1L4S.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 84f3048404c9db9ddf274976abc6582b7adc49b804939568addc3272411ec785
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                PNOS9.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\PNOS9.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 06805033e4b43d1c5b092b8a7116eecb5ba59753a991e8b6a6a79361181264c9
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Q1AHM.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Q1AHM.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 88252f5c15c12c08464b0324c9320faceb062a85fa8004948f26393c0adc7911
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                R03I1.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\R03I1.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 cdb9f552a4ae45b750c063cf7e0d3b0e2a640f07eb83859aaebbc484340b7ce4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                VQEMS.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\VQEMS.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 8e0c1b7071736d2052762028ad8b64caef97f2fc60f26d686fb45f56198ea599
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                WM7EJ.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WM7EJ.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 9ac9c608d4113fa8316165a1fb1e7fb9c96e5376a550844c5159b70e20f7d253
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                X6BB6.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\X6BB6.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 78859e9c558ac78daeb66e8b7231d858e26505f6e02d27c95b82e4dc9a908a27
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Z41A4.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Z41A4.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 1b86582a21152ffa680b8d6a9c5a19ec98b81a1c4a106a2af149f8cbee6018de
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Z540X.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Z540X.exe
                                                                                                                                                • Size 1.6MB
                                                                                                                                                • SHA256 c6aa6c114590ab75645b52608ea635c4deac5292cdf0484224fbdc26b906a9df
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                memory/2860-0-0x0000000000400000-0x0000000000530000-memory.dmp
                                                                                                                                                Download