Overview

overview

7

Static

static

3

aafa97b01b...7b.exe

windows10-2004-x64

7

aafa97b01b...7b.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    131s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/08/2026, 21:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    aafa97b01b91cb5695935e5753c1fb200da26b727364abbb22cd287ee7b1167b.exe
  • Size 1.6MB
  • Sample260814-zyk45aca57
  • SHA256 aafa97b01b91cb5695935e5753c1fb200da26b727364abbb22cd287ee7b1167b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aafa97b01b91cb5695935e5753c1fb200da26b727364abbb22cd287ee7b1167b.exe
    "C:\Users\Admin\AppData\Local\Temp\aafa97b01b91cb5695935e5753c1fb200da26b727364abbb22cd287ee7b1167b.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3864
    • C:\Users\Admin\AppData\Local\Temp\P9M2T.exe
      "C:\Users\Admin\AppData\Local\Temp\P9M2T.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1684
      • C:\Users\Admin\AppData\Local\Temp\86194.exe
        "C:\Users\Admin\AppData\Local\Temp\86194.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3328
        • C:\Users\Admin\AppData\Local\Temp\PDR3K.exe
          "C:\Users\Admin\AppData\Local\Temp\PDR3K.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1196
          • C:\Users\Admin\AppData\Local\Temp\5V051.exe
            "C:\Users\Admin\AppData\Local\Temp\5V051.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4360
            • C:\Users\Admin\AppData\Local\Temp\40F56.exe
              "C:\Users\Admin\AppData\Local\Temp\40F56.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4560
              • C:\Users\Admin\AppData\Local\Temp\1I1TH.exe
                "C:\Users\Admin\AppData\Local\Temp\1I1TH.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1052
                • C:\Users\Admin\AppData\Local\Temp\3G8O7.exe
                  "C:\Users\Admin\AppData\Local\Temp\3G8O7.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2972
                  • C:\Users\Admin\AppData\Local\Temp\OG9R9.exe
                    "C:\Users\Admin\AppData\Local\Temp\OG9R9.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2252
                    • C:\Users\Admin\AppData\Local\Temp\977JN.exe
                      "C:\Users\Admin\AppData\Local\Temp\977JN.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:1452
                      • C:\Users\Admin\AppData\Local\Temp\PSNU7.exe
                        "C:\Users\Admin\AppData\Local\Temp\PSNU7.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3136
                        • C:\Users\Admin\AppData\Local\Temp\94392.exe
                          "C:\Users\Admin\AppData\Local\Temp\94392.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3168
                          • C:\Users\Admin\AppData\Local\Temp\YF923.exe
                            "C:\Users\Admin\AppData\Local\Temp\YF923.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2336
                            • C:\Users\Admin\AppData\Local\Temp\K3F22.exe
                              "C:\Users\Admin\AppData\Local\Temp\K3F22.exe"
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:2060
                              • C:\Users\Admin\AppData\Local\Temp\46P4G.exe
                                "C:\Users\Admin\AppData\Local\Temp\46P4G.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:3388
                                • C:\Users\Admin\AppData\Local\Temp\Y7TWZ.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Y7TWZ.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3808
                                  • C:\Users\Admin\AppData\Local\Temp\E3RSM.exe
                                    "C:\Users\Admin\AppData\Local\Temp\E3RSM.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3364
                                    • C:\Users\Admin\AppData\Local\Temp\F2B4S.exe
                                      "C:\Users\Admin\AppData\Local\Temp\F2B4S.exe"
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:4656
                                      • C:\Users\Admin\AppData\Local\Temp\ETWJC.exe
                                        "C:\Users\Admin\AppData\Local\Temp\ETWJC.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:1804
                                        • C:\Users\Admin\AppData\Local\Temp\X1X58.exe
                                          "C:\Users\Admin\AppData\Local\Temp\X1X58.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:2400
                                          • C:\Users\Admin\AppData\Local\Temp\1M9CB.exe
                                            "C:\Users\Admin\AppData\Local\Temp\1M9CB.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:3056
                                            • C:\Users\Admin\AppData\Local\Temp\I5KQ0.exe
                                              "C:\Users\Admin\AppData\Local\Temp\I5KQ0.exe"
                                              22⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:1796
                                              • C:\Users\Admin\AppData\Local\Temp\4M7RN.exe
                                                "C:\Users\Admin\AppData\Local\Temp\4M7RN.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:1072
                                                • C:\Users\Admin\AppData\Local\Temp\34967.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\34967.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3040
                                                  • C:\Users\Admin\AppData\Local\Temp\3SLTZ.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\3SLTZ.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1772
                                                    • C:\Users\Admin\AppData\Local\Temp\DM81Q.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\DM81Q.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3468
                                                      • C:\Users\Admin\AppData\Local\Temp\2M231.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2M231.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1056
                                                        • C:\Users\Admin\AppData\Local\Temp\CP487.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\CP487.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4452
                                                          • C:\Users\Admin\AppData\Local\Temp\5930A.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\5930A.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4596
                                                            • C:\Users\Admin\AppData\Local\Temp\K1508.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\K1508.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4928
                                                              • C:\Users\Admin\AppData\Local\Temp\N25Y7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\N25Y7.exe"
                                                                31⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1644
                                                                • C:\Users\Admin\AppData\Local\Temp\3JZ6B.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\3JZ6B.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4676
                                                                  • C:\Users\Admin\AppData\Local\Temp\OD4MI.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\OD4MI.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3176
                                                                    • C:\Users\Admin\AppData\Local\Temp\L1J19.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\L1J19.exe"
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:216
                                                                      • C:\Users\Admin\AppData\Local\Temp\I0O51.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\I0O51.exe"
                                                                        35⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1708
                                                                        • C:\Users\Admin\AppData\Local\Temp\D7SL0.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\D7SL0.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1760
                                                                          • C:\Users\Admin\AppData\Local\Temp\4D6R0.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\4D6R0.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5108
                                                                            • C:\Users\Admin\AppData\Local\Temp\1K59R.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\1K59R.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:764
                                                                              • C:\Users\Admin\AppData\Local\Temp\GB1E6.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\GB1E6.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1756
                                                                                • C:\Users\Admin\AppData\Local\Temp\VH0J2.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\VH0J2.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:536
                                                                                  • C:\Users\Admin\AppData\Local\Temp\3V73T.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\3V73T.exe"
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2328
                                                                                    • C:\Users\Admin\AppData\Local\Temp\A183A.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\A183A.exe"
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2628
                                                                                      • C:\Users\Admin\AppData\Local\Temp\96GF2.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\96GF2.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:2352
                                                                                        • C:\Users\Admin\AppData\Local\Temp\H06VY.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\H06VY.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5104
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6XMFR.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\6XMFR.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:632
                                                                                            • C:\Users\Admin\AppData\Local\Temp\16IRU.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\16IRU.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3696
                                                                                              • C:\Users\Admin\AppData\Local\Temp\6E8J4.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\6E8J4.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2024
                                                                                                • C:\Users\Admin\AppData\Local\Temp\C96TK.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\C96TK.exe"
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2780
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TKKC5.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\TKKC5.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2724
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9A131.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9A131.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:552
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9A8UE.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9A8UE.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4372
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\34I6X.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\34I6X.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1484
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FOMW9.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\FOMW9.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:628
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\08551.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\08551.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4624
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\G530M.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\G530M.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1252
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\30ES0.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\30ES0.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:2076
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\9FRBE.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\9FRBE.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4292
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Q253O.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Q253O.exe"
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2276
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\IVKOC.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\IVKOC.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:888
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9EJ6Y.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\9EJ6Y.exe"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:1456
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\N6JGW.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\N6JGW.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:700
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\UJ798.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\UJ798.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:644
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\B7D8D.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\B7D8D.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:3088
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\R8638.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\R8638.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1956
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\13UCZ.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\13UCZ.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4600
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\62PP5.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\62PP5.exe"
                                                                                                                                      66⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:3052
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\P4O5Y.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\P4O5Y.exe"
                                                                                                                                        67⤵
                                                                                                                                          PID:3584
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\09WT8.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\09WT8.exe"
                                                                                                                                            68⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:2668
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\GN31D.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\GN31D.exe"
                                                                                                                                              69⤵
                                                                                                                                                PID:3528
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\M254S.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\M254S.exe"
                                                                                                                                                  70⤵
                                                                                                                                                    PID:1556
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P700T.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P700T.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      PID:4412
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\93DB1.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\93DB1.exe"
                                                                                                                                                        72⤵
                                                                                                                                                          PID:2580
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3G0B4.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3G0B4.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:4264
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\5AG27.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\5AG27.exe"
                                                                                                                                                              74⤵
                                                                                                                                                                PID:3840
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\KG9X2.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\KG9X2.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  PID:1068
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\JOF3M.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\JOF3M.exe"
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4608
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\GN079.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\GN079.exe"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:4892
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\151IS.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\151IS.exe"
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        PID:2284
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\O35IW.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\O35IW.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3800
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\B2SV3.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\B2SV3.exe"
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:844
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\YZ4M9.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\YZ4M9.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3548
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\G7CSF.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\G7CSF.exe"
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:4920
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\J6IZ0.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\J6IZ0.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    PID:4164
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3A807.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3A807.exe"
                                                                                                                                                                                      84⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4728
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1G1S6.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1G1S6.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                          PID:5092
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\M31Z6.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\M31Z6.exe"
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5080
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\UVCV8.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\UVCV8.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                                PID:2208
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\HDLKU.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\HDLKU.exe"
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:3620
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\NK469.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\NK469.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    PID:3484
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P94FU.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P94FU.exe"
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0LRAB.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0LRAB.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                            PID:4140
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\56II5.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\56II5.exe"
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:204
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TEE07.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TEE07.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                  PID:2548
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\A2817.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\A2817.exe"
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Z4J08.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Z4J08.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\82BX2.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\82BX2.exe"
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                        PID:4996
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0M3O6.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0M3O6.exe"
                                                                                                                                                                                                                          97⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5Z660.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\5Z660.exe"
                                                                                                                                                                                                                            98⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\L37V5.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\L37V5.exe"
                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:3788
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\D75D4.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\D75D4.exe"
                                                                                                                                                                                                                                100⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1824
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6OMX2.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6OMX2.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:1616
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\GCR01.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\GCR01.exe"
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\R32H2.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\R32H2.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:4048
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\LNTF9.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\LNTF9.exe"
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:2592
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0R54R.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0R54R.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                              PID:408
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\R543W.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\R543W.exe"
                                                                                                                                                                                                                                                106⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:2608
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\N4862.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\N4862.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                    PID:3824
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9A6E4.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9A6E4.exe"
                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:1324
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7785Y.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7785Y.exe"
                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        PID:1704
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7IQEP.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7IQEP.exe"
                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2692
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\YM26B.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\YM26B.exe"
                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:4888
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\K22N9.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\K22N9.exe"
                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\51K7K.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\51K7K.exe"
                                                                                                                                                                                                                                                                113⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                PID:2764
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\91E6L.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\91E6L.exe"
                                                                                                                                                                                                                                                                  114⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3292
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\49VW6.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\49VW6.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:4172
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\PCFO2.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\PCFO2.exe"
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                        PID:2660
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\K043U.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\K043U.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1308
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9YVCS.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9YVCS.exe"
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:3908
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\05C9N.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\05C9N.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                  PID:1236
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\HFWJ2.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\HFWJ2.exe"
                                                                                                                                                                                                                                                                                    120⤵
                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                    PID:4320
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\G322R.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\G322R.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      PID:2236
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\NZ2J0.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\NZ2J0.exe"
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:2392
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\YJ18O.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\YJ18O.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                            PID:2496
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6UJ11.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6UJ11.exe"
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:852
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\643X7.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\643X7.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                  PID:2460
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\W0NE1.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\W0NE1.exe"
                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                      PID:2520
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Y8RZA.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Y8RZA.exe"
                                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                                          PID:1508
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9S260.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9S260.exe"
                                                                                                                                                                                                                                                                                                            128⤵
                                                                                                                                                                                                                                                                                                              PID:2040
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\6KOQ5.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\6KOQ5.exe"
                                                                                                                                                                                                                                                                                                                129⤵
                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                PID:4500
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\87EI7.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\87EI7.exe"
                                                                                                                                                                                                                                                                                                                  130⤵
                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\J08V6.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\J08V6.exe"
                                                                                                                                                                                                                                                                                                                    131⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P6NT8.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P6NT8.exe"
                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                      PID:4204
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8GIWM.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8GIWM.exe"
                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\UK33N.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\UK33N.exe"
                                                                                                                                                                                                                                                                                                                            134⤵
                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:336
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\M78B4.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\M78B4.exe"
                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                PID:1356
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\D4HM5.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\D4HM5.exe"
                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                    PID:2992
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7S6T4.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7S6T4.exe"
                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                        PID:1596
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\71W9G.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\71W9G.exe"
                                                                                                                                                                                                                                                                                                                                          138⤵
                                                                                                                                                                                                                                                                                                                                            PID:4076
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4V1H0.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4V1H0.exe"
                                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:3236
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3B826.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3B826.exe"
                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4196
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2Y295.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2Y295.exe"
                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    PID:4948
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\OLYF7.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\OLYF7.exe"
                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4256
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\MZ6X3.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\MZ6X3.exe"
                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\N0290.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\N0290.exe"
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                              PID:3928
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\G70BJ.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\G70BJ.exe"
                                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R1C20.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\R1C20.exe"
                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                    PID:4084
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1CJU8.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\1CJU8.exe"
                                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5056
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\16Q08.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\16Q08.exe"
                                                                                                                                                                                                                                                                                                                                                                          148⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1584
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\I8P36.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\I8P36.exe"
                                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1872
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\QHEYY.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\QHEYY.exe"
                                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  PID:3752
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\389F0.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\389F0.exe"
                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:1780
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\TK013.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\TK013.exe"
                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4708
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\V56SH.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\V56SH.exe"
                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:1476
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\V7C37.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\V7C37.exe"
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:432
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\OEV4V.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\OEV4V.exe"
                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\78YGW.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\78YGW.exe"
                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\U3M0J.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\U3M0J.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2556
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\F2391.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\F2391.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1948
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\OHK11.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\OHK11.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\W8266.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\W8266.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:980
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CKQ0A.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\CKQ0A.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4748
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5W1U3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5W1U3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\326EN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\326EN.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\87AMW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\87AMW.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1P2ER.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\1P2ER.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2684
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\X84Y2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\X84Y2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3O098.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\3O098.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\H1M8Z.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\H1M8Z.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\NO1LQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\NO1LQ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3N050.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3N050.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4884
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\U42W3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\U42W3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:176
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Y4HN4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Y4HN4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\URIND.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\URIND.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6QA7L.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6QA7L.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1V84M.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1V84M.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4MH6G.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\4MH6G.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\A65JP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\A65JP.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\OFI37.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\OFI37.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\39WRH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\39WRH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\01S7K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\01S7K.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8B3S8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8B3S8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\5LL7K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\5LL7K.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\G8HG0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\G8HG0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\LTW12.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\LTW12.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\VYQG2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\VYQG2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\87168.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\87168.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\61TGT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\61TGT.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0OA21.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0OA21.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7Q81F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7Q81F.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\B28JD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\B28JD.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\408P0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\408P0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1YKKS.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1YKKS.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8896B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8896B.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2508

                                                                                                                                                Network

                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                      Replay Monitor

                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                      Downloads

                                                                                                                                                      1I1TH.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1I1TH.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 c2d16a1dba85c3879438f54b42b5c8f510afc1f1fa9870bc29c745a47edb0998
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      1M9CB.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\1M9CB.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 6c55a7e8e20de3d398b54f723eba3e244a195ea50a2f06fbd2c79ae57ab11068
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      2M231.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2M231.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 b5e31f7cc6385a9f98a766f0417fc9f7bddcbf912bc813059c0ba83656a2d21d
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      34967.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\34967.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 09149da4134666ee717540de9ab8a80de8f454d46d576f3cabd1d681899b6ff7
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      3G8O7.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3G8O7.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 60638308d947147fba667d777674666eac73a61df7553e019dc8501976e273a1
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      3JZ6B.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3JZ6B.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 bc57a5d6869d6cc13e4b17a0fbf14f950e4565d6112d9fd661f55b730027ffaf
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      3SLTZ.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\3SLTZ.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 8bd2e30955babf4cd488130ea54edffe2d873e70069fa1547728ea68db153f1f
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      40F56.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\40F56.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 ba7f493d16c8d496367c798f07e5d582980b1758070110ef9b8e9971b5151165
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      46P4G.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\46P4G.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 32c1cb7ca6a6c1e86f5f484d72a60125a76d7f3c7767fd820c49545b34748765
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      4M7RN.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\4M7RN.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 c5b2c11b29c878bb247ff5a2fe4de03c9d1832756f8c306891ef807db788daa7
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      5930A.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\5930A.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 5402b2cfb493f61a169ea704af0b308db19c1a80708ec4f33a3a64f198df8b56
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      5V051.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\5V051.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 f1f90ea3559704a4ddd3c13f84897c647aa71479aace9f6fab2fb0d828b66c9c
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      86194.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\86194.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 2bbea66f8b9225b20a331461f18985af26bdadc19b71c2ee97f3293213102f70
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      94392.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\94392.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 38120a0eaf31d3f3356229d08f414181998705871fd1d312af2e3113bb272103
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      977JN.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\977JN.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 641c33e570c8f066595bec7321277f72de0a5fee03ea0f0290321a36672cb013
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      CP487.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\CP487.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 2ed45da344a259f4fc75a53d9e7f924327d1f4b573f0342fad4d95c2442e9c8d
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      DM81Q.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\DM81Q.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 bf7c1718f2686f6b5576a884f9b14e7d4c069ca3227c6f07dfda704df42d266a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      E3RSM.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\E3RSM.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 56a993f37f5d29e09eaebd67f78f9555c105947f5e104e789bfe3e68bf23f1f2
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      ETWJC.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\ETWJC.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 4f8ea99112d53f73678e93888f123e9fd5a229244073a45b7d55526d752b388a
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      F2B4S.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\F2B4S.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 3489c4a0d088074104e9fbc22550f806201d821e70dfa3592c852463c7c91ea7
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      I5KQ0.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\I5KQ0.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 109f7ff5e1e31ddea8101f083673ef00e0e952d47644dd7c74d6cc42a5c1fd8b
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      K1508.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\K1508.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 eb3b1ac573c8b1a55c254c5b95d6904a372afbae580ce39223c2886b797ca9e4
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      K3F22.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\K3F22.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 aee5722793b5230a1ab44a17a52c3cb9ee2623ee64a7ff7f3ffc469eaa638924
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      N25Y7.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\N25Y7.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 1302c7b0e9b0fc11c982eaae3aeea18f4a5e3053cc4de364046bb112b408b9de
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      OD4MI.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OD4MI.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 ef1dee3ac773bc2096ab5b37035861ad097c2d5b52ff8c36d16ae4dc6ba00552
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      OG9R9.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\OG9R9.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 dcb6b99e718de69b85ba00ab76e527281975317899bf77f33696ba5db4cf85b3
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      P9M2T.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\P9M2T.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 36260ceddaf5f939b93f35ad6613343feb0352eb5c8ecb55f7a00287eda7c39e
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      PDR3K.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\PDR3K.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 953f8cd57f32c667a22e13d2dc9c2a57410350a5649bdc5b58298eb82e911454
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      PSNU7.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\PSNU7.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 badeb051a8fa435c83c112d3210dc959b3e582b76de34f0c36a2867415a93141
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      X1X58.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\X1X58.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 419e5e1a1953c9e288ca7cdbffca149788dc9c1f47c707533322693c755fc047
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      Y7TWZ.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\Y7TWZ.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 6d33b7efbc15ea1ca5d8e97ba3052f42be2422c30dae661a7a63c385f4f8681e
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      YF923.exe
                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\YF923.exe
                                                                                                                                                      • Size 1.6MB
                                                                                                                                                      • SHA256 2f0dec017573711421bc951c3b4c8dc16ec3bac36d02fc3aa0312033b95e40c9
                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                      Submit Download

                                                                                                                                                      memory/3864-0-0x0000000000400000-0x0000000000530000-memory.dmp
                                                                                                                                                      Download