Overview

overview

7

Static

static

5

6199755cb5...63.exe

windows10-2004-x64

7

6199755cb5...63.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    136s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 07:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6199755cb5938dc4f6463184391f10b57b97b2c6a67e75ed762f033c18489b63.exe
  • Size 1.9MB
  • Sample260727-jqdr3sysgs
  • SHA256 6199755cb5938dc4f6463184391f10b57b97b2c6a67e75ed762f033c18489b63
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6199755cb5938dc4f6463184391f10b57b97b2c6a67e75ed762f033c18489b63.exe
    "C:\Users\Admin\AppData\Local\Temp\6199755cb5938dc4f6463184391f10b57b97b2c6a67e75ed762f033c18489b63.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\Temp\36Z5F.exe
      "C:\Users\Admin\AppData\Local\Temp\36Z5F.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Users\Admin\AppData\Local\Temp\1PQKU.exe
        "C:\Users\Admin\AppData\Local\Temp\1PQKU.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Users\Admin\AppData\Local\Temp\14F46.exe
          "C:\Users\Admin\AppData\Local\Temp\14F46.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1368
          • C:\Users\Admin\AppData\Local\Temp\AU6V8.exe
            "C:\Users\Admin\AppData\Local\Temp\AU6V8.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3452
            • C:\Users\Admin\AppData\Local\Temp\52Z0W.exe
              "C:\Users\Admin\AppData\Local\Temp\52Z0W.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3508
              • C:\Users\Admin\AppData\Local\Temp\Q8RV5.exe
                "C:\Users\Admin\AppData\Local\Temp\Q8RV5.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4684
                • C:\Users\Admin\AppData\Local\Temp\19421.exe
                  "C:\Users\Admin\AppData\Local\Temp\19421.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:516
                  • C:\Users\Admin\AppData\Local\Temp\3439R.exe
                    "C:\Users\Admin\AppData\Local\Temp\3439R.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1512
                    • C:\Users\Admin\AppData\Local\Temp\71OT7.exe
                      "C:\Users\Admin\AppData\Local\Temp\71OT7.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:3788
                      • C:\Users\Admin\AppData\Local\Temp\8129R.exe
                        "C:\Users\Admin\AppData\Local\Temp\8129R.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:4688
                        • C:\Users\Admin\AppData\Local\Temp\94392.exe
                          "C:\Users\Admin\AppData\Local\Temp\94392.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4372
                          • C:\Users\Admin\AppData\Local\Temp\6GUOH.exe
                            "C:\Users\Admin\AppData\Local\Temp\6GUOH.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:4224
                            • C:\Users\Admin\AppData\Local\Temp\J5Z2A.exe
                              "C:\Users\Admin\AppData\Local\Temp\J5Z2A.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:2396
                              • C:\Users\Admin\AppData\Local\Temp\2OQ8Y.exe
                                "C:\Users\Admin\AppData\Local\Temp\2OQ8Y.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:4636
                                • C:\Users\Admin\AppData\Local\Temp\G6579.exe
                                  "C:\Users\Admin\AppData\Local\Temp\G6579.exe"
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:4608
                                  • C:\Users\Admin\AppData\Local\Temp\B1H85.exe
                                    "C:\Users\Admin\AppData\Local\Temp\B1H85.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3456
                                    • C:\Users\Admin\AppData\Local\Temp\O1Y3Q.exe
                                      "C:\Users\Admin\AppData\Local\Temp\O1Y3Q.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:4588
                                      • C:\Users\Admin\AppData\Local\Temp\98B6R.exe
                                        "C:\Users\Admin\AppData\Local\Temp\98B6R.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3588
                                        • C:\Users\Admin\AppData\Local\Temp\P1V24.exe
                                          "C:\Users\Admin\AppData\Local\Temp\P1V24.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:3956
                                          • C:\Users\Admin\AppData\Local\Temp\VG265.exe
                                            "C:\Users\Admin\AppData\Local\Temp\VG265.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:1976
                                            • C:\Users\Admin\AppData\Local\Temp\8XG0Y.exe
                                              "C:\Users\Admin\AppData\Local\Temp\8XG0Y.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:3060
                                              • C:\Users\Admin\AppData\Local\Temp\81WT5.exe
                                                "C:\Users\Admin\AppData\Local\Temp\81WT5.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:2096
                                                • C:\Users\Admin\AppData\Local\Temp\VK2DS.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\VK2DS.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4752
                                                  • C:\Users\Admin\AppData\Local\Temp\OHY82.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\OHY82.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3768
                                                    • C:\Users\Admin\AppData\Local\Temp\V127X.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\V127X.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1584
                                                      • C:\Users\Admin\AppData\Local\Temp\227QN.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\227QN.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1952
                                                        • C:\Users\Admin\AppData\Local\Temp\07083.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\07083.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3684
                                                          • C:\Users\Admin\AppData\Local\Temp\X999P.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\X999P.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1968
                                                            • C:\Users\Admin\AppData\Local\Temp\7R2UM.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\7R2UM.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4420
                                                              • C:\Users\Admin\AppData\Local\Temp\FN216.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\FN216.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1988
                                                                • C:\Users\Admin\AppData\Local\Temp\4UB9Q.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\4UB9Q.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2176
                                                                  • C:\Users\Admin\AppData\Local\Temp\Y06Q5.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Y06Q5.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:452
                                                                    • C:\Users\Admin\AppData\Local\Temp\0M2KY.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\0M2KY.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1636
                                                                      • C:\Users\Admin\AppData\Local\Temp\BWFTE.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\BWFTE.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1588
                                                                        • C:\Users\Admin\AppData\Local\Temp\46PD0.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\46PD0.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3924
                                                                          • C:\Users\Admin\AppData\Local\Temp\X0F56.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\X0F56.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2380
                                                                            • C:\Users\Admin\AppData\Local\Temp\PX94Q.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\PX94Q.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2344
                                                                              • C:\Users\Admin\AppData\Local\Temp\1K6WJ.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\1K6WJ.exe"
                                                                                39⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:220
                                                                                • C:\Users\Admin\AppData\Local\Temp\O14E0.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\O14E0.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2352
                                                                                  • C:\Users\Admin\AppData\Local\Temp\HJ3AZ.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\HJ3AZ.exe"
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3940
                                                                                    • C:\Users\Admin\AppData\Local\Temp\76JZ6.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\76JZ6.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4988
                                                                                      • C:\Users\Admin\AppData\Local\Temp\260HY.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\260HY.exe"
                                                                                        43⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2984
                                                                                        • C:\Users\Admin\AppData\Local\Temp\A6V6Z.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\A6V6Z.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3172
                                                                                          • C:\Users\Admin\AppData\Local\Temp\61Z2J.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\61Z2J.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1804
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7M1W2.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\7M1W2.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4284
                                                                                              • C:\Users\Admin\AppData\Local\Temp\81B92.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\81B92.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:1900
                                                                                                • C:\Users\Admin\AppData\Local\Temp\3933E.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3933E.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2792
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\134TW.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\134TW.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2356
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P7UXL.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P7UXL.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4668
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\84V64.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\84V64.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4972
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\69F17.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\69F17.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3732
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\KX394.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\KX394.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3884
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\M524I.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\M524I.exe"
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4784
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8MB9Y.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8MB9Y.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2720
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\J14A4.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\J14A4.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4132
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\21HOR.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\21HOR.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4532
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AN91L.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\AN91L.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2936
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XAK40.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\XAK40.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4048
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\T7L32.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\T7L32.exe"
                                                                                                                          60⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3740
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\B667C.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\B667C.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:464
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1PWZF.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1PWZF.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:1580
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\F45QO.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\F45QO.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:1848
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\JY793.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\JY793.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1232
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\33B3E.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\33B3E.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:3328
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C6L98.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\C6L98.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:3672
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\580EP.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\580EP.exe"
                                                                                                                                        67⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2844
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\48PL0.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\48PL0.exe"
                                                                                                                                          68⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          PID:3232
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\JIU48.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\JIU48.exe"
                                                                                                                                            69⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:5016
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\NESVD.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\NESVD.exe"
                                                                                                                                              70⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4804
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\H6R15.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\H6R15.exe"
                                                                                                                                                71⤵
                                                                                                                                                  PID:3036
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\A4KI9.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\A4KI9.exe"
                                                                                                                                                    72⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:3276
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\EAJDN.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\EAJDN.exe"
                                                                                                                                                      73⤵
                                                                                                                                                        PID:3980
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\28N83.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\28N83.exe"
                                                                                                                                                          74⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:4504
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\167AZ.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\167AZ.exe"
                                                                                                                                                            75⤵
                                                                                                                                                              PID:4528
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\I69D4.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\I69D4.exe"
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:3848
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\36CX4.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\36CX4.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    PID:2840
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\V32K4.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\V32K4.exe"
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:4824
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\J10GA.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\J10GA.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          PID:2280
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1ODQT.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1ODQT.exe"
                                                                                                                                                                            80⤵
                                                                                                                                                                              PID:4260
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11R32.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\11R32.exe"
                                                                                                                                                                                81⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:4940
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\I18JG.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\I18JG.exe"
                                                                                                                                                                                  82⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:2156
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\68FDY.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\68FDY.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1496
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\29GLN.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\29GLN.exe"
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      PID:3064
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\C957Y.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\C957Y.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3928
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5GJ5D.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5GJ5D.exe"
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          PID:3776
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OW893.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\OW893.exe"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2728
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\T020E.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\T020E.exe"
                                                                                                                                                                                              88⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4544
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\261LH.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\261LH.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                  PID:448
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Z85T7.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Z85T7.exe"
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:3548
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6LT23.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6LT23.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      PID:2456
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\52ZUF.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\52ZUF.exe"
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1BME9.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1BME9.exe"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                            PID:3896
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\226YP.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\226YP.exe"
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:4292
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\21NL5.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\21NL5.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  PID:2260
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1F15L.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1F15L.exe"
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:4004
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B3BSV.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\B3BSV.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\W1TLC.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\W1TLC.exe"
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\975F4.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\975F4.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:976
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\H59QN.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\H59QN.exe"
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6OMX2.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6OMX2.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                PID:2768
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\81L5V.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\81L5V.exe"
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RMMI3.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RMMI3.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P21ZU.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P21ZU.exe"
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4200
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\T24LW.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\T24LW.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\G00LZ.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\G00LZ.exe"
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            PID:4196
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1G16U.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\1G16U.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1364
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\P3X67.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\P3X67.exe"
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3524
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\9A6E4.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\9A6E4.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TI3MG.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TI3MG.exe"
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:2116
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\CND15.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\CND15.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                          PID:1744
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N2GWL.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\N2GWL.exe"
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                              PID:3964
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\J12L5.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\J12L5.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4576
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\A9VX7.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\A9VX7.exe"
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                  PID:312
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Y11O1.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Y11O1.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:3636
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0L0OE.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\0L0OE.exe"
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3516
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\L0R09.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\L0R09.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\63221.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\63221.exe"
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:4632
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\8HPU8.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\8HPU8.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:4008
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\HP13D.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\HP13D.exe"
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                PID:2920
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8R0T8.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8R0T8.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                    PID:4080
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XM4FC.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XM4FC.exe"
                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2148
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\HO158.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\HO158.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4564
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5B766.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5B766.exe"
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:2748
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IZD47.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\IZD47.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:3152
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5EBC7.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5EBC7.exe"
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                  PID:4056
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\KH0I8.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\KH0I8.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                    PID:1728
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\XK73N.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\XK73N.exe"
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:3196
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\181KZ.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\181KZ.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:904
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9HI3A.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9HI3A.exe"
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4508T.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4508T.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                                PID:2736
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3DTW1.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3DTW1.exe"
                                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:1084
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\V7695.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\V7695.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:2336
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\J44OA.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\J44OA.exe"
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        PID:1808
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\GKU6B.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\GKU6B.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          PID:1136
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\20E17.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\20E17.exe"
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\QN3V5.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\QN3V5.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\8M8XJ.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\8M8XJ.exe"
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                  PID:3068
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Z209I.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Z209I.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\52798.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\52798.exe"
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:1052
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\72340.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\72340.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                              PID:1032
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\O9783.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\O9783.exe"
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1696
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\81Y51.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\81Y51.exe"
                                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4380
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0LP6L.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0LP6L.exe"
                                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3VZEK.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\3VZEK.exe"
                                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          PID:2944
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\P3MOD.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\P3MOD.exe"
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3396
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\38N5D.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\38N5D.exe"
                                                                                                                                                                                                                                                                                                                                                                147⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\E1L7G.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\E1L7G.exe"
                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:3972
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\U77AZ.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\U77AZ.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\H79P7.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\H79P7.exe"
                                                                                                                                                                                                                                                                                                                                                                        150⤵
                                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                        PID:3044
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\50EP0.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\50EP0.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:1044
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\47IY0.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\47IY0.exe"
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:632
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5LG17.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5LG17.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BM06O.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BM06O.exe"
                                                                                                                                                                                                                                                                                                                                                                                  154⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  PID:1660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\AXLGY.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\AXLGY.exe"
                                                                                                                                                                                                                                                                                                                                                                                    155⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\43Q55.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\43Q55.exe"
                                                                                                                                                                                                                                                                                                                                                                                        156⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4916
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\E0172.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\E0172.exe"
                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\18G13.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\18G13.exe"
                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                              PID:3996
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\17D06.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\17D06.exe"
                                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:372
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4V64J.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4V64J.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5R889.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5R889.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6E7EQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6E7EQ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\23C0C.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\23C0C.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ZGND1.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\ZGND1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K5OQ4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\K5OQ4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1R72N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1R72N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\X37FU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\X37FU.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\WZV65.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\WZV65.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\L3L28.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\L3L28.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0322X.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0322X.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\OAHON.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\OAHON.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\74UX9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\74UX9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\S88C8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\S88C8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:676
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\F51N2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\F51N2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6384T.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6384T.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7U9R6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7U9R6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\01S7K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\01S7K.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\G30X9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\G30X9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8L59D.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8L59D.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\C2TXN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\C2TXN.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\369VY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\369VY.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\L155D.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\L155D.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\AK3SZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\AK3SZ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\JP70K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\JP70K.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\K8ZER.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\K8ZER.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5IJ43.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5IJ43.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1076

                                                                                                          Network

                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                07083.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\07083.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 1f978425bcf4702432f1487eaf4654207deae6bb68e5d39b8eb75077ccad87ff
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                14F46.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\14F46.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 980ce7a4a72790896796c9c02ba607aa0ad1bd0a2ff79b7210758619e0919146
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                19421.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\19421.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 e4e044f05a278577cfdf3089ca6470f4ce2551fca83880c2b9811b2540451947
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                1PQKU.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\1PQKU.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 1e66ceb71bd28875711139686a164ec8656ae443eea2a4af33cde3534cd44677
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                227QN.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\227QN.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 7473bd1aaaa96ff4e112301c5a9f15e2bd00856a20d31e9fee889013c9783617
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                2OQ8Y.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2OQ8Y.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 55062c9d36dd0999ccc9502e3b23328b99f60a876365600b2f8f7d3025d43429
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                3439R.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\3439R.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 434bdcce5cd22fc181a3fef418d0834140111a07d224e794ab82f66019fb09af
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                36Z5F.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\36Z5F.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 9c5180df41372bfa1cd7fc341d3d87694a403b1c333d3ef152a40ee3c1bcca63
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                4UB9Q.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\4UB9Q.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 7a5a9791452031da774819391432cdb19e6aefa734a3646a261b77012224c5ea
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                52Z0W.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\52Z0W.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 60aaec1ab477af494343e9ad778f05c23749ce8b9f79fc48af3d1ee13dc5e3f4
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                6GUOH.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\6GUOH.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 d4948f9ae2aad55d8c4a8b801539763b0f7853d0d07d7a035ed20d2e4cecbfbf
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                71OT7.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\71OT7.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 4cb6620ffe9f9b23f38819ccb27606a264d48c06709eb2184d0b09fb27535c6b
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                7R2UM.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7R2UM.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 0861859964f761ef88d881655dce0eea6fe71744ba39fe172856bf077d5b9cac
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                8129R.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8129R.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 dce4574597a9d1a9662ce5b19e47f52611e74fb20f2eb11806bdaf1a0befbbec
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                81WT5.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\81WT5.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 15d19720aab5b53c99a06530950f1809b8cad19a57ad1fc52396aadfd0713017
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                8XG0Y.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\8XG0Y.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 d012b94cbdbf19e2acdd2a1edf61bc38d0377148b351b1529b178e87a05e609f
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                94392.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\94392.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 02f8ad6b234844c148c721ca0385dbb5e70ffd4ddb9adb2b8f67bec4b7de51b7
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                98B6R.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\98B6R.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 c89c075b33497f2fd8589f64c8fed75f3905121c0e186fcc34852a3761331896
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                AU6V8.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\AU6V8.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 0b07e5e0a8c58ecc6d0c4ef36bf47ef15cfbfa98953bd5670bae3b878f58bce1
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                B1H85.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\B1H85.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 18bb602f7df156ae234d3389147c2e1ca857c97ad94b0796d3759f5f0a21bd46
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                FN216.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\FN216.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 4435c51614f69947c53a1c1872f7fe8e6aad442c115fc73d84130aeffb6bbb4c
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                G6579.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\G6579.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 8c72518d0f56e6d8f6404f0f3e014dd4a30a2ef62a4e986fba78b38f140832d4
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                J5Z2A.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\J5Z2A.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 a3fcaf1c87190e33ce28452e7343a0be3d08d7496f882b4e5f5f25924d9afc9e
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                O1Y3Q.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\O1Y3Q.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 ae8c48e6ea41883b152c79935f4cf211bbe276f36650c4fe80a04fc7e25042c7
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                OHY82.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\OHY82.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 e90ca8d6d8ed247b2705dc230729a02c7a49a93a51bb3a155770b216ff73ca37
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                P1V24.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\P1V24.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 1175209e613476af00f3dbb86c208872dfffbf597af76dcd636729aeec177ae6
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Q8RV5.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Q8RV5.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 915e033ee2c449e8cdbf2e8b08430f3ebb7f9bf17675174f35ef9684a080db00
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                V127X.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\V127X.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 0285d731a117878f2b2925a2ad7b18ee739335a9417b60617b577c8f15a2a8b4
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                VG265.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\VG265.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 34752435118790b45df6fedcff09c8769264e08cbedd2f059bf7a64838edb79d
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                VK2DS.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\VK2DS.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 e3b34f08ba20bf64f447237d1e53e13407fca71213f0faf0e9545dfd294e4ddb
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                X999P.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\X999P.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 f5584baa8061b4170094bde1e994b7c1d44199bc55e9d29b641c141bf436a6f2
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                Y06Q5.exe
                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Y06Q5.exe
                                                                                                                • Size 1.9MB
                                                                                                                • SHA256 461904594d1ae1e0ce142936a8fd42c4c6ac52a444a20965fb6dbce5efc9f5b0
                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                Submit Download

                                                                                                                memory/220-366-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/220-357-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/452-319-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/516-70-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/516-81-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1140-20-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1140-31-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1368-30-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1368-41-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1512-80-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1512-91-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1584-252-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1588-335-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1588-326-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1636-318-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1636-327-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1804-413-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1804-404-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1900-429-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1900-420-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1952-262-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1968-271-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1968-282-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1976-195-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1976-206-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1988-291-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/1988-302-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2096-225-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2176-311-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2176-301-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2344-349-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2344-358-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2352-373-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2352-365-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2356-444-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2380-350-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2396-128-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2396-139-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2720-489-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2720-481-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2792-428-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2792-436-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2984-397-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/2984-388-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3060-215-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3060-205-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3172-405-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3172-396-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3216-11-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3216-0-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3216-1-0x00000000004BB000-0x00000000004BC000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3452-51-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3452-40-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3456-167-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3508-61-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3508-50-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3588-186-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3588-176-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3684-272-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3684-261-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3732-467-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3768-243-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3788-90-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3788-101-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3884-474-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3884-466-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3924-342-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3924-334-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3940-381-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/3956-196-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4224-129-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4284-412-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4284-421-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4372-119-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4420-281-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4420-292-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4468-21-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4468-10-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4588-177-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4588-166-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4608-157-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4636-148-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4636-138-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4668-452-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4668-443-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4684-71-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4684-60-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4688-100-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4688-110-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4752-224-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4752-234-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4784-482-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4972-451-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4972-459-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4988-380-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download

                                                                                                                memory/4988-389-0x0000000000400000-0x000000000053F000-memory.dmp
                                                                                                                Download