Overview

overview

10

Static

static

3

2026-09-29...ry.exe

windows10-2004-x64

10

2026-09-29...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    39s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 02:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
  • Size 9.5MB
  • Sample260930-ddhydaxt3q
  • SHA256 2b51fa5e2d80e8cb8e9397b1fb50c02dd211aae213fb38a533c31fcffac8aae2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryneshtapersistencespywarestealer

Malware Config

Signatures

  • Family: Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Detect Neshta payload 64 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:884
      • C:\Users\Admin\AppData\Local\Temp\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies system executable filetype association
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
          "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3628
          • C:\Windows\svchost.exe
            "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3116
            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
              "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious use of WriteProcessMemory
              PID:4596
              • C:\Windows\svchost.com
                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3676
                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:4304
                  • C:\Windows\svchost.com
                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3964
                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3196
                      • C:\Windows\svchost.com
                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4456
                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3624
                          • C:\Windows\svchost.com
                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3980
                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:5056
                              • C:\Windows\svchost.com
                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3712
                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                  16⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:4324
                                  • C:\Windows\svchost.com
                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:2728
                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                      18⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:2444
                                      • C:\Windows\svchost.com
                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4736
                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Drops file in Windows directory
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:3476
                                          • C:\Windows\svchost.com
                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2532
                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                              22⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:1628
                                              • C:\Windows\svchost.com
                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                23⤵
                                                • Executes dropped EXE
                                                PID:1504
                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                  24⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2748
                                                  • C:\Windows\svchost.com
                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4320
                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2312
                                                      • C:\Windows\svchost.com
                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4924
                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Drops file in Windows directory
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3124
                                                          • C:\Windows\svchost.com
                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1960
                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                              30⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Drops file in Windows directory
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4400
                                                              • C:\Windows\svchost.com
                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4432
                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3308
                                                                  • C:\Windows\svchost.com
                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:3840
                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                      34⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Modifies registry class
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4764
                                                                      • C:\Windows\svchost.com
                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:812
                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Drops file in Windows directory
                                                                          • Modifies registry class
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:532
                                                                          • C:\Windows\svchost.com
                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1032
                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                              38⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:540
                                                                              • C:\Windows\svchost.com
                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3716
                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4440
                                                                                  • C:\Windows\svchost.com
                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3336
                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1232
                                                                                      • C:\Windows\svchost.com
                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5096
                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Windows directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3160
                                                                                          • C:\Windows\svchost.com
                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2044
                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4992
                                                                                              • C:\Windows\svchost.com
                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4976
                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                  48⤵
                                                                                                  • Checks computer location settings
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Windows directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:4972
                                                                                                  • C:\Windows\svchost.com
                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:3968
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in Windows directory
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4364
                                                                                                      • C:\Windows\svchost.com
                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:3048
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                          52⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3584
                                                                                                          • C:\Windows\svchost.com
                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:4228
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1280
                                                                                                              • C:\Windows\svchost.com
                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3776
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:4208
                                                                                                                  • C:\Windows\svchost.com
                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2096
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3500
                                                                                                                      • C:\Windows\svchost.com
                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2688
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Modifies system executable filetype association
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:3384
                                                                                                                          • C:\Windows\svchost.com
                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:732
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:1036
                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:2388
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                  64⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1000
                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                    65⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:4516
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                      66⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:232
                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                        67⤵
                                                                                                                                          PID:2872
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                            68⤵
                                                                                                                                              PID:2440
                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                69⤵
                                                                                                                                                  PID:2068
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                    70⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:2956
                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                      71⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:3896
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                        72⤵
                                                                                                                                                        • Modifies registry class
                                                                                                                                                        PID:4256
                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                          73⤵
                                                                                                                                                            PID:4600
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                              74⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                              PID:1860
                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                75⤵
                                                                                                                                                                  PID:656
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                    76⤵
                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                    PID:1088
                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                      77⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4116
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                        78⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                        PID:2944
                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:4756
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                            80⤵
                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                            PID:4064
                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:3880
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                PID:1844
                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:372
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:1568
                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                        PID:1260
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                          86⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                          PID:3180
                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                            87⤵
                                                                                                                                                                                              PID:2240
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3356
                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:2776
                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1488
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                        PID:4108
                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          PID:1756
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                            94⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                            PID:860
                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:4028
                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                    PID:4072
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      PID:3696
                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:2328
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:876
                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                              PID:1016
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                PID:1728
                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:4704
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:3664
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:4748
                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:3328
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                  PID:4648
                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                      PID:892
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:2500
                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                          113⤵
                                                                                                                                                                                                                                                            PID:1012
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:3976
                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                115⤵
                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2592
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        PID:4424
                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                            PID:3620
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                              PID:4156
                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                121⤵
                                                                                                                                                                                                                                                                                  PID:1780
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:4360
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                          PID:1096
                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                              PID:212
                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:3332
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:3832
                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                      PID:3468
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:3344
                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3800
                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:4020
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                134⤵
                                                                                                                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                        PID:3360
                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:2148
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                              PID:3508
                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                  PID:3540
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                        PID:3796
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                          142⤵
                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:4152
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                              PID:3756
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                145⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4472
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                    PID:204
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                      147⤵
                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                      PID:4196
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                        148⤵
                                                                                                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                        PID:4872
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                          149⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2508
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                  PID:1952
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                      PID:160
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                        PID:1852
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                          PID:4148
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                              PID:4904
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                159⤵
                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                  160⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                  PID:4688
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4840
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                        PID:3736
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                          163⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4728
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                              164⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                              PID:4288
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                            169⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                              170⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                          174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2416
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3256
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5108
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3784
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\3582-490\2026-0~1.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5512
                                                                                                                                                                                                                                                                    • C:\Windows\svchost.exe
                                                                                                                                                                                                                                                                      C:\Windows\svchost.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                      PID:3132

                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                          ACROBR~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE
                                                                                                                                                                                                                                                                          • Size 328KB
                                                                                                                                                                                                                                                                          • SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          ACROTE~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
                                                                                                                                                                                                                                                                          • Size 86KB
                                                                                                                                                                                                                                                                          • SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          ADOBEC~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE
                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                          • SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          ADelRCP.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe
                                                                                                                                                                                                                                                                          • Size 175KB
                                                                                                                                                                                                                                                                          • SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          RdrCEF.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe
                                                                                                                                                                                                                                                                          • Size 9.4MB
                                                                                                                                                                                                                                                                          • SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          AcroRd32.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
                                                                                                                                                                                                                                                                          • Size 2.4MB
                                                                                                                                                                                                                                                                          • SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          WCCHRO~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE
                                                                                                                                                                                                                                                                          • Size 183KB
                                                                                                                                                                                                                                                                          • SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          Eula.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe
                                                                                                                                                                                                                                                                          • Size 131KB
                                                                                                                                                                                                                                                                          • SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          FULLTR~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE
                                                                                                                                                                                                                                                                          • Size 254KB
                                                                                                                                                                                                                                                                          • SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          LOGTRA~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE
                                                                                                                                                                                                                                                                          • Size 386KB
                                                                                                                                                                                                                                                                          • SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          READER~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE
                                                                                                                                                                                                                                                                          • Size 92KB
                                                                                                                                                                                                                                                                          • SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          WOW_HE~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE
                                                                                                                                                                                                                                                                          • Size 147KB
                                                                                                                                                                                                                                                                          • SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          arh.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe
                                                                                                                                                                                                                                                                          • Size 125KB
                                                                                                                                                                                                                                                                          • SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          32BITM~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE
                                                                                                                                                                                                                                                                          • Size 142KB
                                                                                                                                                                                                                                                                          • SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          64BITM~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
                                                                                                                                                                                                                                                                          • Size 278KB
                                                                                                                                                                                                                                                                          • SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          ADOBEA~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE
                                                                                                                                                                                                                                                                          • Size 454KB
                                                                                                                                                                                                                                                                          • SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          AdobeARM.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe
                                                                                                                                                                                                                                                                          • Size 1.2MB
                                                                                                                                                                                                                                                                          • SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          jaureg.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe
                                                                                                                                                                                                                                                                          • Size 555KB
                                                                                                                                                                                                                                                                          • SHA256 c5a99f42100834599e4995d0a178b32b772a6e774a4050a6bb00438af0a6a1f3
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          VSTOIN~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE
                                                                                                                                                                                                                                                                          • Size 121KB
                                                                                                                                                                                                                                                                          • SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          java.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe
                                                                                                                                                                                                                                                                          • Size 325KB
                                                                                                                                                                                                                                                                          • SHA256 5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          javaw.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe
                                                                                                                                                                                                                                                                          • Size 325KB
                                                                                                                                                                                                                                                                          • SHA256 e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          javaws.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe
                                                                                                                                                                                                                                                                          • Size 505KB
                                                                                                                                                                                                                                                                          • SHA256 da73b6e071788372702104b9c72b6697e84e7c75e248e964996700b77c6b6f1c
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          DISABL~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\Google\Update\DISABL~1.EXE
                                                                                                                                                                                                                                                                          • Size 5.7MB
                                                                                                                                                                                                                                                                          • SHA256 3acf99624820fd862ac30780021108f0ff2df60db3df351cd17400404f279d3c
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          IE_TO_~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE
                                                                                                                                                                                                                                                                          • Size 557KB
                                                                                                                                                                                                                                                                          • SHA256 6bb357968887ad126579fb157f455e359ea036a4960a9f98f5cec1fe53931c98
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          COOKIE~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE
                                                                                                                                                                                                                                                                          • Size 161KB
                                                                                                                                                                                                                                                                          • SHA256 5fee43e3295682e179d6e10c568aeb640bbbcf0d6b962fd27f5b372a45fc272d
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          ELEVAT~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE
                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                          • SHA256 47eb0dc0cd08f4faa389621c43d6407283e3c315012ef1078a6018c117f195b2
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          IDENTI~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE
                                                                                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                                                                                          • SHA256 94c99d3284962585c15fdb061e0685287df11c872ef930263e251d8d3084d5b0
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          setup.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe
                                                                                                                                                                                                                                                                          • Size 6.6MB
                                                                                                                                                                                                                                                                          • SHA256 4ea8adca8a7f73fc71c7e45ef98f8c422a8b161ca6b6fcd912aec701bebd08a5
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          MSEDGE~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE
                                                                                                                                                                                                                                                                          • Size 3.2MB
                                                                                                                                                                                                                                                                          • SHA256 fc0701d5c47cbd883929abfccf5f6ba88f76a4d0ebfa2d28160cf6c28f018e26
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          msedge.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe
                                                                                                                                                                                                                                                                          • Size 3.8MB
                                                                                                                                                                                                                                                                          • SHA256 6773bf49098b9fa85725651bc789ec2bcef5dd563a356043468c1f7b235defef
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          ie_to_edge_stub.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe
                                                                                                                                                                                                                                                                          • Size 562KB
                                                                                                                                                                                                                                                                          • SHA256 533d6da98378d3b1bb120b192bc5bd20bbeed6e123fe9fc6c15a4a3504932c71
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          setup.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\INSTAL~1\setup.exe
                                                                                                                                                                                                                                                                          • Size 7.1MB
                                                                                                                                                                                                                                                                          • SHA256 70c13c14a682d65fd82ec72f578e160617f8b7c164414bcce613a9b9ebd0c878
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          cookie_exporter.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe
                                                                                                                                                                                                                                                                          • Size 155KB
                                                                                                                                                                                                                                                                          • SHA256 30d26d2f766f716cd6b21cdc15065ee4191760ef0d37de51f67dead898fb8e7c
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          elevated_tracing_service.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe
                                                                                                                                                                                                                                                                          • Size 3.8MB
                                                                                                                                                                                                                                                                          • SHA256 c13ce5f473ff68ffdea61e8a4800008f527054f4561f2bf7853f6769d0c02dc5
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          elevation_service.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe
                                                                                                                                                                                                                                                                          • Size 2.2MB
                                                                                                                                                                                                                                                                          • SHA256 8c53985c403e44c0c899c2d1f2a0b8afb1f17fb928ff866271de7952c9ff7c66
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          identity_helper.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe
                                                                                                                                                                                                                                                                          • Size 1.4MB
                                                                                                                                                                                                                                                                          • SHA256 cd0adfcf43373e05fcf8836cc998cb17e3aaade9f8b190e28ce4331bd026f23c
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          msedge_pwa_launcher.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe
                                                                                                                                                                                                                                                                          • Size 1.8MB
                                                                                                                                                                                                                                                                          • SHA256 2c31887681976e9691cfed32b98a9f81898beaaee9ea3f7a90fe695b84190511
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          msedgewebview2.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe
                                                                                                                                                                                                                                                                          • Size 3.4MB
                                                                                                                                                                                                                                                                          • SHA256 c0566225b047e50773acde8ada568ef7612809e74f2cc200504e60cf7a917c68
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          notification_click_helper.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe
                                                                                                                                                                                                                                                                          • Size 1.6MB
                                                                                                                                                                                                                                                                          • SHA256 0faa9f1f62a95136d454efa51e6f8e8ff06a08d344fd26dc2216de09f6fbee4e
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          MSEDGE~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE
                                                                                                                                                                                                                                                                          • Size 1.5MB
                                                                                                                                                                                                                                                                          • SHA256 b4bdab2b2c7731923854f254ba1494c25a11331293c0ee4939afd10ba1e2b575
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          PWAHEL~1.EXE
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE
                                                                                                                                                                                                                                                                          • Size 1.4MB
                                                                                                                                                                                                                                                                          • SHA256 df233ebee614cd9117f7e467f16f4c2225aadbc59213a5695913a4a87f792d6a
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          msedge.exe
                                                                                                                                                                                                                                                                          • Path C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe
                                                                                                                                                                                                                                                                          • Size 4.0MB
                                                                                                                                                                                                                                                                          • SHA256 18f4157c2dabb39cf84662e17c471f69f679840a70be3a4685e0c4ed8ccc207a
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
                                                                                                                                                                                                                                                                          • Size 9.4MB
                                                                                                                                                                                                                                                                          • SHA256 5828f2a84ab0f2b09bc6478585083258b2e1b9776860f20e8258a67d9de56b6c
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
                                                                                                                                                                                                                                                                          • Size 9.4MB
                                                                                                                                                                                                                                                                          • SHA256 cecd12804f731abde41817b1b5ca3b33e08a7ee9036cad71bbaf10e5fa680a5d
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-09-29_3aa5f1115bb47dbc9d3be957826d9ff4_coinminer_elex_glassworm_jeefo_ransomhub_wannacry.exe
                                                                                                                                                                                                                                                                          • Size 9.4MB
                                                                                                                                                                                                                                                                          • SHA256 b1eaf1a2a387f4379a54d135b430958b8ed7d4aeb60107a92fcecde765438945
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          svchost.com
                                                                                                                                                                                                                                                                          • Path C:\Windows\svchost.com
                                                                                                                                                                                                                                                                          • Size 40KB
                                                                                                                                                                                                                                                                          • SHA256 bf355cb3b86fba368a6d2425f360e330062e57810ceef5f6c5732da351289a7e
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          svchost.exe
                                                                                                                                                                                                                                                                          • Path C:\Windows\svchost.exe
                                                                                                                                                                                                                                                                          • Size 35KB
                                                                                                                                                                                                                                                                          • SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                          memory/532-325-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/540-333-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/732-418-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/812-318-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/884-12-0x0000000000400000-0x000000000040D000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1000-421-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1032-326-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1036-419-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1232-351-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1280-400-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1504-270-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1620-334-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1628-269-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1960-294-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/1992-3-0x0000000000400000-0x000000000040E000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2044-360-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2096-409-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2312-285-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2388-420-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2444-258-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2532-267-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2688-417-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2728-251-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/2748-277-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3048-384-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3116-126-0x0000000000400000-0x000000000040D000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3124-293-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3132-335-0x0000000000400000-0x000000000040D000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3160-359-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3196-226-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3308-309-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3336-344-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3476-266-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3500-411-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3584-392-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3624-234-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3628-24-0x0000000000400000-0x000000000040E000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3676-161-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3712-243-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3716-336-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3776-401-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3840-310-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3964-219-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3968-376-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/3980-235-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4208-403-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4228-393-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4304-199-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4320-278-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4324-250-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4364-391-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4400-301-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4432-302-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4440-343-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4456-227-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4596-377-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4736-259-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4764-317-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4924-286-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4972-375-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4976-368-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/4992-367-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/5056-242-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                          memory/5096-352-0x0000000000400000-0x000000000041B000-memory.dmp
                                                                                                                                                                                                                                                                          Download