Overview

overview

7

Static

static

3

0bba4d0c43...dc.exe

windows10-2004-x64

7

0bba4d0c43...dc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    106s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 03:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0bba4d0c430c01f2699d97a4c5b2f850d709a7fa21a8769ad89561051cfd59dc.exe
  • Size 1.6MB
  • Sample260816-dy5b4scl5s
  • SHA256 0bba4d0c430c01f2699d97a4c5b2f850d709a7fa21a8769ad89561051cfd59dc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0bba4d0c430c01f2699d97a4c5b2f850d709a7fa21a8769ad89561051cfd59dc.exe
    "C:\Users\Admin\AppData\Local\Temp\0bba4d0c430c01f2699d97a4c5b2f850d709a7fa21a8769ad89561051cfd59dc.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\3544L.exe
      "C:\Users\Admin\AppData\Local\Temp\3544L.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Users\Admin\AppData\Local\Temp\X8069.exe
        "C:\Users\Admin\AppData\Local\Temp\X8069.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3544
        • C:\Users\Admin\AppData\Local\Temp\14Y42.exe
          "C:\Users\Admin\AppData\Local\Temp\14Y42.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4160
          • C:\Users\Admin\AppData\Local\Temp\2KDS6.exe
            "C:\Users\Admin\AppData\Local\Temp\2KDS6.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2988
            • C:\Users\Admin\AppData\Local\Temp\35HN7.exe
              "C:\Users\Admin\AppData\Local\Temp\35HN7.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1776
              • C:\Users\Admin\AppData\Local\Temp\RX24D.exe
                "C:\Users\Admin\AppData\Local\Temp\RX24D.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1864
                • C:\Users\Admin\AppData\Local\Temp\HE87H.exe
                  "C:\Users\Admin\AppData\Local\Temp\HE87H.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:116
                  • C:\Users\Admin\AppData\Local\Temp\R794T.exe
                    "C:\Users\Admin\AppData\Local\Temp\R794T.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1444
                    • C:\Users\Admin\AppData\Local\Temp\HE3KP.exe
                      "C:\Users\Admin\AppData\Local\Temp\HE3KP.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4616
                      • C:\Users\Admin\AppData\Local\Temp\C66W5.exe
                        "C:\Users\Admin\AppData\Local\Temp\C66W5.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:1068
                        • C:\Users\Admin\AppData\Local\Temp\UE53Y.exe
                          "C:\Users\Admin\AppData\Local\Temp\UE53Y.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4224
                          • C:\Users\Admin\AppData\Local\Temp\92O9Q.exe
                            "C:\Users\Admin\AppData\Local\Temp\92O9Q.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2780
                            • C:\Users\Admin\AppData\Local\Temp\3OVKD.exe
                              "C:\Users\Admin\AppData\Local\Temp\3OVKD.exe"
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:4736
                              • C:\Users\Admin\AppData\Local\Temp\Z41A4.exe
                                "C:\Users\Admin\AppData\Local\Temp\Z41A4.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:3872
                                • C:\Users\Admin\AppData\Local\Temp\S34D5.exe
                                  "C:\Users\Admin\AppData\Local\Temp\S34D5.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  • Suspicious use of WriteProcessMemory
                                  PID:3668
                                  • C:\Users\Admin\AppData\Local\Temp\XO1C4.exe
                                    "C:\Users\Admin\AppData\Local\Temp\XO1C4.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    PID:3748
                                    • C:\Users\Admin\AppData\Local\Temp\E2EV9.exe
                                      "C:\Users\Admin\AppData\Local\Temp\E2EV9.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:4252
                                      • C:\Users\Admin\AppData\Local\Temp\4S079.exe
                                        "C:\Users\Admin\AppData\Local\Temp\4S079.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:1040
                                        • C:\Users\Admin\AppData\Local\Temp\29604.exe
                                          "C:\Users\Admin\AppData\Local\Temp\29604.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          PID:4284
                                          • C:\Users\Admin\AppData\Local\Temp\UR7PD.exe
                                            "C:\Users\Admin\AppData\Local\Temp\UR7PD.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            PID:512
                                            • C:\Users\Admin\AppData\Local\Temp\3H6F8.exe
                                              "C:\Users\Admin\AppData\Local\Temp\3H6F8.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • Suspicious use of WriteProcessMemory
                                              PID:4128
                                              • C:\Users\Admin\AppData\Local\Temp\FMO2Y.exe
                                                "C:\Users\Admin\AppData\Local\Temp\FMO2Y.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • Suspicious use of WriteProcessMemory
                                                PID:3248
                                                • C:\Users\Admin\AppData\Local\Temp\04T8A.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\04T8A.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:644
                                                  • C:\Users\Admin\AppData\Local\Temp\P7D9P.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\P7D9P.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:212
                                                    • C:\Users\Admin\AppData\Local\Temp\4O9XJ.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\4O9XJ.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3364
                                                      • C:\Users\Admin\AppData\Local\Temp\7NWW8.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7NWW8.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4900
                                                        • C:\Users\Admin\AppData\Local\Temp\C6SD0.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\C6SD0.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2396
                                                          • C:\Users\Admin\AppData\Local\Temp\453W3.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\453W3.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4436
                                                            • C:\Users\Admin\AppData\Local\Temp\FB7UO.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\FB7UO.exe"
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:2980
                                                              • C:\Users\Admin\AppData\Local\Temp\55KH9.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\55KH9.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2960
                                                                • C:\Users\Admin\AppData\Local\Temp\393I7.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\393I7.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3716
                                                                  • C:\Users\Admin\AppData\Local\Temp\529Z3.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\529Z3.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2948
                                                                    • C:\Users\Admin\AppData\Local\Temp\41MZR.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\41MZR.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4796
                                                                      • C:\Users\Admin\AppData\Local\Temp\R1Z7L.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\R1Z7L.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1792
                                                                        • C:\Users\Admin\AppData\Local\Temp\3N011.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\3N011.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:2436
                                                                          • C:\Users\Admin\AppData\Local\Temp\09FFE.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\09FFE.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3012
                                                                            • C:\Users\Admin\AppData\Local\Temp\4D6XN.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\4D6XN.exe"
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2232
                                                                              • C:\Users\Admin\AppData\Local\Temp\29XY0.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\29XY0.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1400
                                                                                • C:\Users\Admin\AppData\Local\Temp\A28H0.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\A28H0.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2932
                                                                                  • C:\Users\Admin\AppData\Local\Temp\4PW7H.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\4PW7H.exe"
                                                                                    41⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4292
                                                                                    • C:\Users\Admin\AppData\Local\Temp\CD36O.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\CD36O.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1712
                                                                                      • C:\Users\Admin\AppData\Local\Temp\5TV18.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\5TV18.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3808
                                                                                        • C:\Users\Admin\AppData\Local\Temp\9LBRJ.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\9LBRJ.exe"
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4632
                                                                                          • C:\Users\Admin\AppData\Local\Temp\0OM40.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\0OM40.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1896
                                                                                            • C:\Users\Admin\AppData\Local\Temp\15L5F.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\15L5F.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1592
                                                                                              • C:\Users\Admin\AppData\Local\Temp\08HFJ.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\08HFJ.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2392
                                                                                                • C:\Users\Admin\AppData\Local\Temp\G4057.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\G4057.exe"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2464
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\BP1K6.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\BP1K6.exe"
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:1180
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\QD03F.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\QD03F.exe"
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2304
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\O14E0.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\O14E0.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4236
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\OO0BF.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\OO0BF.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4928
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0ZKQ1.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0ZKQ1.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:2716
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4HR7J.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\4HR7J.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:720
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\96QBH.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\96QBH.exe"
                                                                                                                55⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1084
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\60NT7.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\60NT7.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3316
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4V4L4.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4V4L4.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5024
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\5452E.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\5452E.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2744
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0D0BC.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0D0BC.exe"
                                                                                                                        59⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1852
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0345Y.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0345Y.exe"
                                                                                                                          60⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3620
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2E057.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2E057.exe"
                                                                                                                            61⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3616
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BM41D.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\BM41D.exe"
                                                                                                                              62⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:2916
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\FRI8V.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\FRI8V.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2548
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4282Z.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4282Z.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:4260
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8669X.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\8669X.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:4360
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DVXTX.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\DVXTX.exe"
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3948
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\E206J.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\E206J.exe"
                                                                                                                                        67⤵
                                                                                                                                          PID:3848
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\R370E.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\R370E.exe"
                                                                                                                                            68⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4820
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\HB3B5.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\HB3B5.exe"
                                                                                                                                              69⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4112
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\12P20.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\12P20.exe"
                                                                                                                                                70⤵
                                                                                                                                                  PID:4316
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\V0398.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\V0398.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:3720
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9CB85.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9CB85.exe"
                                                                                                                                                      72⤵
                                                                                                                                                        PID:3400
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8425G.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\8425G.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          PID:4560
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Z8EI1.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Z8EI1.exe"
                                                                                                                                                            74⤵
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3928
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\AXTQ3.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\AXTQ3.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:1200
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3XV40.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\3XV40.exe"
                                                                                                                                                                76⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:4504
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6EGJ3.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6EGJ3.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:1004
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1XB8R.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1XB8R.exe"
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    PID:2268
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P5VI1.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P5VI1.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      PID:2088
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0ATFE.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0ATFE.exe"
                                                                                                                                                                        80⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:1668
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\NVI7K.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\NVI7K.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                          PID:2676
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0144M.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0144M.exe"
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4640
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\13685.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\13685.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                                PID:4584
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4IX41.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4IX41.exe"
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  PID:3352
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\YU8JN.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\YU8JN.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5040
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\QX735.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\QX735.exe"
                                                                                                                                                                                      86⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:4416
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0KP63.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0KP63.exe"
                                                                                                                                                                                        87⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4404
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\U906R.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\U906R.exe"
                                                                                                                                                                                          88⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          PID:4980
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\G0292.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\G0292.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:968
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\16I18.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\16I18.exe"
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4172
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\675PQ.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\675PQ.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:2992
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Z6355.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Z6355.exe"
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                    PID:3980
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\767TC.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\767TC.exe"
                                                                                                                                                                                                      93⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      PID:4592
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\35XI5.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\35XI5.exe"
                                                                                                                                                                                                        94⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:3504
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\PO95G.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\PO95G.exe"
                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          PID:3708
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3RK40.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\3RK40.exe"
                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                              PID:812
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\SNILE.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\SNILE.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2095H.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2095H.exe"
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                    PID:2148
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\M7MF6.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\M7MF6.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\A18YW.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\A18YW.exe"
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\9A480.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\9A480.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\6X604.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\6X604.exe"
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                              PID:3768
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\GN079.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\GN079.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:4256
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\501GX.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\501GX.exe"
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\6NB34.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\6NB34.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2228
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\P4BXT.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\P4BXT.exe"
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:3932
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\322D0.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\322D0.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:1980
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\23BKI.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\23BKI.exe"
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:3064
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\E8R32.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\E8R32.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3460
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\MP736.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\MP736.exe"
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:1708
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\F93NX.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\F93NX.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  PID:4908
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\X704M.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\X704M.exe"
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:1800
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\R84PJ.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\R84PJ.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      PID:3700
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\DW591.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\DW591.exe"
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:3384
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4Q952.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\4Q952.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                            PID:2520
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\X42H5.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\X42H5.exe"
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:3936
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\39340.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\39340.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                PID:692
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\NV3S0.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\NV3S0.exe"
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:3336
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\UIG66.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\UIG66.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:5112
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\S918L.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\S918L.exe"
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9CQQ9.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9CQQ9.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        PID:4696
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\95YLE.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\95YLE.exe"
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          PID:4912
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\NSPL6.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\NSPL6.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:1576
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\MQ166.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\MQ166.exe"
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\BWDJE.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\BWDJE.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\9Y5N7.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\9Y5N7.exe"
                                                                                                                                                                                                                                                                                      126⤵
                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                      PID:2156
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\X271L.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\X271L.exe"
                                                                                                                                                                                                                                                                                        127⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\6OMX2.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\6OMX2.exe"
                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                            PID:4488
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\30G9H.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\30G9H.exe"
                                                                                                                                                                                                                                                                                              129⤵
                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                              PID:1304
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\68503.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\68503.exe"
                                                                                                                                                                                                                                                                                                130⤵
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WZLTA.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\WZLTA.exe"
                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:224
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4H3O0.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4H3O0.exe"
                                                                                                                                                                                                                                                                                                    132⤵
                                                                                                                                                                                                                                                                                                      PID:676
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\PK6N8.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\PK6N8.exe"
                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\5N5U8.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\5N5U8.exe"
                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\0GI7N.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\0GI7N.exe"
                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4644
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\M3V29.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\M3V29.exe"
                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4936
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2C6LA.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2C6LA.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                  PID:628
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4UTM1.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\4UTM1.exe"
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2404
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\676BC.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\676BC.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                        PID:4840
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0JW8Q.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\0JW8Q.exe"
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1JQ2J.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1JQ2J.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                            PID:1616
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\88B0J.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\88B0J.exe"
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                PID:440
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\CG3IA.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\CG3IA.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\H2EYZ.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\H2EYZ.exe"
                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                        PID:4532
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\1H63C.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\1H63C.exe"
                                                                                                                                                                                                                                                                                                                                          145⤵
                                                                                                                                                                                                                                                                                                                                            PID:1580
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\KB57H.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\KB57H.exe"
                                                                                                                                                                                                                                                                                                                                              146⤵
                                                                                                                                                                                                                                                                                                                                                PID:1468
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\6DSU2.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\6DSU2.exe"
                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\M2065.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\M2065.exe"
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                        PID:100
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\35750.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\35750.exe"
                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:2220
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\JN8S7.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\JN8S7.exe"
                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\54873.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\54873.exe"
                                                                                                                                                                                                                                                                                                                                                                151⤵
                                                                                                                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                PID:1272
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4H49D.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4H49D.exe"
                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3520
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\SN9YI.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\SN9YI.exe"
                                                                                                                                                                                                                                                                                                                                                                      153⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:3052
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\652B1.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\652B1.exe"
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1732
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7A6S0.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7A6S0.exe"
                                                                                                                                                                                                                                                                                                                                                                            155⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4884
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\71YI5.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\71YI5.exe"
                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3A660.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\3A660.exe"
                                                                                                                                                                                                                                                                                                                                                                                    157⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3024
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9XM0I.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\9XM0I.exe"
                                                                                                                                                                                                                                                                                                                                                                                        158⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4388
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\S0Q0A.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\S0Q0A.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\K8GA4.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\K8GA4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\A96A5.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\A96A5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\8CT4Y.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\8CT4Y.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1964
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\W663J.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\W663J.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2344
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\31VYF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\31VYF.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\LL6H0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\LL6H0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0P81V.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0P81V.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2280
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22AS0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\22AS0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\71W9G.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\71W9G.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\89T6J.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\89T6J.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0LP6L.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\0LP6L.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\M4K2E.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\M4K2E.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5F297.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\5F297.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\R2BS0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\R2BS0.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7RVI9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7RVI9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WQKD5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\WQKD5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\C6UA5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\C6UA5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ZV494.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ZV494.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\103F3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\103F3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\26GZ4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\26GZ4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8I2BJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\8I2BJ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\IF9L6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\IF9L6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1FQMA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\1FQMA.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\18FJ3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\18FJ3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\G309S.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\G309S.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\74EQ1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\74EQ1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\SIH7Y.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\SIH7Y.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\31P38.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\31P38.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\85Q7L.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\85Q7L.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2I3JL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2I3JL.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ZGND1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\ZGND1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\PV7MV.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\PV7MV.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\V409P.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\V409P.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\0003J.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\0003J.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\53G43.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\53G43.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\915W8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\915W8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\LE59P.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\LE59P.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\376YF.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\376YF.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7D9O4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7D9O4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\F03UR.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\F03UR.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\LSGZL.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\LSGZL.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\UG8IO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\UG8IO.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\CT9FQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\CT9FQ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1K6LD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\1K6LD.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\TIYP7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\TIYP7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4664

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads

                                                                                                                                                                04T8A.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\04T8A.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 71323fec44c7b40102247956c98c4f8ea505b65a2e695c36c6fc9a80d10e2695
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                14Y42.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\14Y42.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 e8e253f84d62ff40cdb00340d215d8ed9dbfca0222c440b9ba506bf7db71670d
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                29604.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\29604.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 6e95a8e64fddcfc4a6ab0301da7e93f35cab663d393d8085f476a3ca06a5cda9
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                2KDS6.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2KDS6.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 4df5d012ad9ad657fa9afa5c165dbe94f4aec052817217b53860cc9b656d265f
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                3544L.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\3544L.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 528a0576232f582ba88956a1649c705633571ec7ccf39fcd8f29e767d2e5fc6b
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                35HN7.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\35HN7.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 e01736ef650d319a59b6f872b759156c7f51a1abd537a90e3195fe25f9d82b74
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                393I7.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\393I7.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 6ed6b7e762ed526eaf0fe3df96ce694e6b472e39aee3504014643c6dcbb477d8
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                3H6F8.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\3H6F8.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 a78b557b49bc4f266c838bd427567a54e712e3290cb42129a8ff84c8dd3883bb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                3OVKD.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\3OVKD.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 0fbb1962a3e102ae2145b88a7cc3e72b8f147066eff3b29846ca66fc533a9fc7
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                453W3.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\453W3.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 f8aa5df8d9d02761c269f06be576367f5e0b258e7c78757238437436ea56bb09
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                4O9XJ.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\4O9XJ.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 16c3fa6aab8ac0b3111e3419fa7e8092750df217dd03c2aec6d1d3f0a55dfc9c
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                4S079.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\4S079.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 9be272d2df5d049839ed4823202715b4e138ef308d10bc2cd86c6b82f1e1e7cb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                529Z3.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\529Z3.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 93946e36123383138cb802f8d350c3a454b5e84f5fcd2094a0ec19d56517e805
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                55KH9.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\55KH9.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 b78b7361b8d26754a1f3bae1b530d5348aa8e5c8f6d2596fdfa1909b40ffabee
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                7NWW8.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7NWW8.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 cfb90210f84f469c438582afff64442c6afe47a4f7d710aa8fe1ea9cbb5b7798
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                92O9Q.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\92O9Q.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 098b7f833d394c0fad1f7c42b8051783198022ac773f7d9ca77a55b18a8b4a24
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                C66W5.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\C66W5.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 3470aa2333261e99453f3ccd31b104b7908f284ed701a0078fc2a6c076be6ee2
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                C6SD0.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\C6SD0.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 5c345257583a54fbb65a0d223df9076754b170f970f49cf86803de0881e794cc
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                E2EV9.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\E2EV9.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 e462318576f31ee1f7f7232ba99d1059b7036173ad541dfc5b49ae9175181594
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                FB7UO.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\FB7UO.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 fa8afef09efee09922c3ec3c3671f582666781aa8fb807992d4fa217958786ce
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                FMO2Y.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\FMO2Y.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 5af1e6cb9584b532112719d7207f5883708c63bc0262d571c8ad2e60e351a1ca
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                HE3KP.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\HE3KP.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 8e46cb77d630df7fd09c4d21e4d04d440f0f6b5d3e2c2fffba39d805c7456cd1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                HE87H.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\HE87H.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 28bcc0b41f1861c11a08ce30ab01a91dc3a5cb620e0fe5d68548007c903cf8d4
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                P7D9P.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\P7D9P.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 4436500cbfcc5cac610b084f452601ccaf4f82189e7ee2f12380dd2220513930
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                R794T.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\R794T.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 8ed09b4e48af6078ffc9c4aa628e11f763e5662218c964fe9577632ea2d1a9f6
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                RX24D.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\RX24D.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 b561f7b1461a8c6ca7ade62145dd5ffac81fad31dee653093aec1b00165f192a
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                S34D5.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\S34D5.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 bdaa87d11675c11219b7eead2ae7405dac30430a94099500ad8b8983c66d8be1
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                UE53Y.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UE53Y.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 cef9890dd449fc192fc47a8d80d8ee228fc8b28df53f4072dc54500ab5b9fde5
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                UR7PD.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\UR7PD.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 23677a50e8f2fd3b1c6328024be13c7ba90d43e596632ed4e7be6c6b23eaeecb
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                X8069.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\X8069.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 a184c3fe02990c2c3689061af02070c0f661f6cdc2eeb29ffc997c3e9499c003
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                XO1C4.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\XO1C4.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 070fc9fdc0fefdd5240d6c7050d126b7fff65e24b7e36c65461b8c0356446826
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                Z41A4.exe
                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\Z41A4.exe
                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                • SHA256 1516dba47fe67bced75e8156b1ffcf6fc8696782f79fa2bc1bae2f9c554a1fbd
                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                Submit Download

                                                                                                                                                                memory/640-0-0x0000000000400000-0x0000000000530000-memory.dmp
                                                                                                                                                                Download