17bfda2d300d5321642789fd5b826318735766d5e5d5c9b2e7c93e520ad87881

Analysis

max time kernel
149s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260911-de
resource tags

arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KeyGen.exe
Size 708KB
Sample260930-tecqraca54
SHA256 17bfda2d300d5321642789fd5b826318735766d5e5d5c9b2e7c93e520ad87881
MD5 e4ad77c21fb6497dd469e9e50036832b
SHA1 9275ac1286c9ecec3e704d8eea4708295dee1819
SHA512 1a4addaaa94aedfc57378c393443ae67240ff0852fd9a1fa4e44a12832505ae0d6c256f419cd677dc3575b196b68d4b688e4b8291267523a58359ca8e5d10d43
SSDEEP 12288:XYkc9t2Sll/3Mn6WeH3lgoN8YWo/Pv7vnXvWNqTf6WfydeLPwsgjrPO9:XYkcL53Mnmr4E7n/WNqundIwsg+9
TLSH
T1F0F42351EA5945C7C8A30B7114BFAE5232BA9E390AB3274B1359BB3DF4F3351121A783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2192	keygen.exe
1524	keygen.exe
3172	keygen.exe
1028	keygen.exe
3044	keygen.exe
4156	keygen.exe
900	keygen.exe
1716	keygen.exe
2872	keygen.exe
1452	keygen.exe
3924	keygen.exe
216	keygen.exe
3472	keygen.exe
3736	keygen.exe
3336	keygen.exe
3504	keygen.exe
64	keygen.exe
920	keygen.exe
5104	keygen.exe
4788	keygen.exe
3372	keygen.exe
2884	keygen.exe
3432	keygen.exe
3856	keygen.exe
3488	keygen.exe
1464	keygen.exe
3940	keygen.exe
1424	keygen.exe
2336	keygen.exe
3676	keygen.exe
1428	keygen.exe
4252	keygen.exe
4684	keygen.exe
4380	keygen.exe
2348	keygen.exe
628	keygen.exe
756	keygen.exe
1132	keygen.exe
1508	keygen.exe
3684	keygen.exe
1844	keygen.exe
4776	keygen.exe
2468	keygen.exe
1692	keygen.exe
904	keygen.exe
4848	keygen.exe
4420	keygen.exe
3772	keygen.exe
1252	keygen.exe
624	keygen.exe
2756	keygen.exe
2208	keygen.exe
4436	keygen.exe
4900	keygen.exe
1272	keygen.exe
5140	keygen.exe
5176	keygen.exe
5212	keygen.exe
5248	keygen.exe
5284	keygen.exe
5320	keygen.exe
5356	keygen.exe
5392	keygen.exe
5432	keygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 2192	4272	KeyGen.exe	83
PID 2192 wrote to memory of 1524	2192	keygen.exe	85
PID 1524 wrote to memory of 3172	1524	keygen.exe	86
PID 3172 wrote to memory of 1028	3172	keygen.exe	87
PID 1028 wrote to memory of 3044	1028	keygen.exe	88
PID 3044 wrote to memory of 4156	3044	keygen.exe	89
PID 4156 wrote to memory of 900	4156	keygen.exe	90
PID 900 wrote to memory of 1716	900	keygen.exe	91
PID 1716 wrote to memory of 2872	1716	keygen.exe	92
PID 2872 wrote to memory of 1452	2872	keygen.exe	94
PID 1452 wrote to memory of 3924	1452	keygen.exe	95
PID 3924 wrote to memory of 216	3924	keygen.exe	96
PID 216 wrote to memory of 3472	216	keygen.exe	99
PID 3472 wrote to memory of 3736	3472	keygen.exe	100
PID 3736 wrote to memory of 3336	3736	keygen.exe	101
PID 3336 wrote to memory of 3504	3336	keygen.exe	102
PID 3504 wrote to memory of 64	3504	keygen.exe	103
PID 64 wrote to memory of 920	64	keygen.exe	104
PID 920 wrote to memory of 5104	920	keygen.exe	105
PID 5104 wrote to memory of 4788	5104	keygen.exe	106
PID 4788 wrote to memory of 3372	4788	keygen.exe	107
PID 3372 wrote to memory of 2884	3372	keygen.exe	108
PID 2884 wrote to memory of 3432	2884	keygen.exe	109
PID 3432 wrote to memory of 3856	3432	keygen.exe	110
PID 3856 wrote to memory of 3488	3856	keygen.exe	111
PID 3488 wrote to memory of 1464	3488	keygen.exe	112
PID 1464 wrote to memory of 3940	1464	keygen.exe	113
PID 3940 wrote to memory of 1424	3940	keygen.exe	114
PID 1424 wrote to memory of 2336	1424	keygen.exe	117
PID 2336 wrote to memory of 3676	2336	keygen.exe	118
PID 3676 wrote to memory of 1428	3676	keygen.exe	119
PID 1428 wrote to memory of 4252	1428	keygen.exe	120
PID 4252 wrote to memory of 4684	4252	keygen.exe	121
PID 4684 wrote to memory of 4380	4684	keygen.exe	122
PID 4380 wrote to memory of 2348	4380	keygen.exe	123
PID 2348 wrote to memory of 628	2348	keygen.exe	124
PID 628 wrote to memory of 756	628	keygen.exe	125
PID 756 wrote to memory of 1132	756	keygen.exe	126
PID 1132 wrote to memory of 1508	1132	keygen.exe	127
PID 1508 wrote to memory of 3684	1508	keygen.exe	129
PID 3684 wrote to memory of 1844	3684	keygen.exe	130
PID 1844 wrote to memory of 4776	1844	keygen.exe	132
PID 4776 wrote to memory of 2468	4776	keygen.exe	133
PID 2468 wrote to memory of 1692	2468	keygen.exe	134
PID 1692 wrote to memory of 904	1692	keygen.exe	135
PID 904 wrote to memory of 4848	904	keygen.exe	136
PID 4848 wrote to memory of 4420	4848	keygen.exe	137
PID 4420 wrote to memory of 3772	4420	keygen.exe	138
PID 3772 wrote to memory of 1252	3772	keygen.exe	139
PID 1252 wrote to memory of 624	1252	keygen.exe	140
PID 624 wrote to memory of 2756	624	keygen.exe	141
PID 2756 wrote to memory of 2208	2756	keygen.exe	142
PID 2208 wrote to memory of 4436	2208	keygen.exe	143
PID 4436 wrote to memory of 4900	4436	keygen.exe	144
PID 4900 wrote to memory of 1272	4900	keygen.exe	145
PID 1272 wrote to memory of 5140	1272	keygen.exe	146
PID 5140 wrote to memory of 5176	5140	keygen.exe	147
PID 5176 wrote to memory of 5212	5176	keygen.exe	148
PID 5212 wrote to memory of 5248	5212	keygen.exe	149
PID 5248 wrote to memory of 5284	5248	keygen.exe	150
PID 5284 wrote to memory of 5320	5284	keygen.exe	151
PID 5320 wrote to memory of 5356	5320	keygen.exe	152
PID 5356 wrote to memory of 5392	5356	keygen.exe	153
PID 5392 wrote to memory of 5432	5392	keygen.exe	154

C:\Users\Admin\AppData\Local\Temp\KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\keygen.exe
    C:\Users\Admin\AppData\Local\Temp\keygen.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\keygen.exe
      C:\Users\Admin\AppData\Local\Temp\keygen.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        23⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        24⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        25⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        26⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        27⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        29⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        30⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        31⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        32⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        33⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        35⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        38⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        40⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        42⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        43⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        44⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        45⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        47⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        50⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        51⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        54⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        57⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        58⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        60⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        63⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        64⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        65⤵
        Executes dropped EXE
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        66⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        67⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        68⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        69⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        70⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        71⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        72⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        73⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        74⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        75⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        76⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        77⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        78⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        79⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        80⤵
        System Location Discovery: System Language Discovery
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        81⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        83⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        84⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        85⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        86⤵
        System Location Discovery: System Language Discovery
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        88⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        89⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        90⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        91⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        92⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        93⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        94⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        95⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        96⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        97⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        98⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        99⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        100⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        101⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        102⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        103⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        104⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        105⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        106⤵
        System Location Discovery: System Language Discovery
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        107⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        108⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        109⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        110⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        111⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        112⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        113⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        114⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        115⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        116⤵
        System Location Discovery: System Language Discovery
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        117⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        118⤵
        System Location Discovery: System Language Discovery
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        120⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        121⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        122⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        123⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        124⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        125⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        126⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        127⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        128⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        129⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        130⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        131⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        132⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        133⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        134⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        135⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        136⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        137⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        138⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        139⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        141⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        142⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        143⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        144⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        145⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        146⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        147⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        148⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        149⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        150⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        151⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        152⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        153⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        154⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        155⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        156⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        157⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        158⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        160⤵
        System Location Discovery: System Language Discovery
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        161⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        162⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        163⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        164⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        165⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        166⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        167⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        168⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        169⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        170⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        171⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        172⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        173⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        174⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        175⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        176⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        177⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        178⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        179⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        180⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        181⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        182⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        183⤵
        System Location Discovery: System Language Discovery
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        184⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        185⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        186⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        187⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        188⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        189⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        190⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        191⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        192⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        193⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        194⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        195⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        196⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        197⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        198⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        200⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        201⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        202⤵
        System Location Discovery: System Language Discovery
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        203⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        204⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        205⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        206⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        207⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        208⤵
        System Location Discovery: System Language Discovery
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        209⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        210⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        211⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        212⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        213⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        214⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        215⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        216⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        217⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        218⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        219⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        220⤵
        System Location Discovery: System Language Discovery
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        221⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        222⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        223⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        224⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        225⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        226⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        227⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        228⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        229⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        230⤵
        System Location Discovery: System Language Discovery
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        231⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        232⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        233⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        234⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        235⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        236⤵
        System Location Discovery: System Language Discovery
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        237⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        238⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        239⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        240⤵
        System Location Discovery: System Language Discovery
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        241⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        242⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        243⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        244⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        245⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        246⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        247⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        248⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        249⤵
        System Location Discovery: System Language Discovery
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        250⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        251⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        252⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        253⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        254⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        255⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        256⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        257⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        258⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        259⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        260⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        262⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        263⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        264⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        265⤵
        System Location Discovery: System Language Discovery
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        266⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        268⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        269⤵
        System Location Discovery: System Language Discovery
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        270⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        271⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        272⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        274⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        275⤵
        System Location Discovery: System Language Discovery
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        276⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        277⤵
        System Location Discovery: System Language Discovery
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        278⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        279⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        280⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        281⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        282⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        283⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        284⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        285⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        286⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        287⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        288⤵
        System Location Discovery: System Language Discovery
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        289⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        290⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        291⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        292⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        293⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        294⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        295⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        296⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        297⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        298⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        299⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        300⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        301⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        302⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        303⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        304⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        
        C:\Users\Admin\AppData\Local\Temp\keygen.exe
        305⤵
        
        PID:10644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BASSMOD.dll

Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
Size 33KB
SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
MD5 e4ec57e8508c5c4040383ebe6d367928
SHA1 b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA512 77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
SSDEEP 768:qQmS5iUgi5czW+DlrQOS1DeDdjgNtbX4O6DHix84H0:qQz5Tgof+DdpS1+djctLSHiZ0
TLSH
T130F2E1B43B18CDE2DDC807F41FE4E6A879DB92026A13DBC5D697CA97328B4914D42F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KeyGen.exe

Path C:\Users\Admin\AppData\Local\Temp\KeyGen.exe
Size 708KB
SHA256 17bfda2d300d5321642789fd5b826318735766d5e5d5c9b2e7c93e520ad87881
MD5 e4ad77c21fb6497dd469e9e50036832b
SHA1 9275ac1286c9ecec3e704d8eea4708295dee1819
SHA512 1a4addaaa94aedfc57378c393443ae67240ff0852fd9a1fa4e44a12832505ae0d6c256f419cd677dc3575b196b68d4b688e4b8291267523a58359ca8e5d10d43
SSDEEP 12288:XYkc9t2Sll/3Mn6WeH3lgoN8YWo/Pv7vnXvWNqTf6WfydeLPwsgjrPO9:XYkcL53Mnmr4E7n/WNqundIwsg+9
TLSH
T1F0F42351EA5945C7C8A30B7114BFAE5232BA9E390AB3274B1359BB3DF4F3351121A783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

R2RUHEKG.dll

Path C:\Users\Admin\AppData\Local\Temp\R2RUHEKG.dll
Size 3KB
SHA256 940f041a89d78bf62b32771023553f9f3b867d58dd87af679508fff6ed0e9144
MD5 abcbaa94b4d828f5c3080c5ddbbbf403
SHA1 42f8010079fb6222f97557fff9377a7276189968
SHA512 24799c073c878f9d2fbf0b8e01dbe0abcf183b950dd991e7a504cfb5f1d370edc558896b7a4607271569bd2fa512b5d76e6f94155955da5bf67e0a8a12a75465
TLSH
T149712073B7B646B6EF39473D1643F69C62F9312013299B48678310963C64CC2752BF55
MD5 SHA1 SHA512 TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 192KB
SHA256 483814757b25a872a33905ae1be0f11849ce5cb2a87942d9264779f12451d274
MD5 d48e9374c26f6662a3f03a34bfa31cdd
SHA1 f3b2477cc3b4b9220511920efff3274409c1ef5d
SHA512 de4d106776dc7e660835f270911b2bef72e346043254e2bb6e5d4b6d8bf2615f8a212e4385baed189935fc7dda62f5c765ecfdc0b800c98555887f0772f380af
SSDEEP 3072:P888888ss6Cxy5Wpv9zyR1Rbcf2EMDiWkMWx2vniA4/:P888888ssN5kF5vNO
TLSH
T15014842CA17B2073F8F563739DAD121AD3693ABB371630C72B6A6CD3892D687BC41511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 128KB
SHA256 16686a06d3587140a584db00e9e3fe346b10d2968307c2856dce07f21967b007
MD5 bdc0e9cdb2b46ada8abfd192d4e1e1de
SHA1 4114fd2e24157840cfdac51ffe47d06d7274eeb7
SHA512 151289cd481a3c6834b5317c5405c069241729f50253c68b01ced38768a3d5a552388cc0f5b2c7ba1c1f47afc09c6848f3e4c75d97eba71992c9319e4dc5acc7
SSDEEP 1536:UoJ888888sswBBcSJFHT8GpEPg2ijRjwHT8GpEPg2ijhX2u8EX2u8jaBKxQNKas5:P888888ss6Cxy5Wpv9zyR1RZ
TLSH
T1DDD3FBAD917710B3F8F143B7ACAE571892592AB7394A34C72F2A4CD3C52C6C7BC85816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 768KB
SHA256 2fda61293c092d497d9f6a70e4e8d26bfaa2d93ec46830b068d9beb3a2d30ac1
MD5 dbb9fba7df71bfb4e070dce946dd83dd
SHA1 5a1e6205722b5802f6fa172055430808323b701d
SHA512 61ed09f5c1f26f63f09601e0a6846ef7321b1b887cea381f80aabd68041e5efb1978b6a778c08e78adc75d316fc22cad0e6b5cb7edcd1d85c68d4a6fc7cbd071
SSDEEP 12288:P888888ssYxN5LF0xgxTqUSTOD2psz+wQTt1CNb7B:P888888ss8yxETNZ29bux9
TLSH
T16AF41911B6A63513F46827324D6D46599335BE5A3F33E3873BC97DAAAA2E7C36C11300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bgm.xm

Path C:\Users\Admin\AppData\Local\Temp\bgm.xm
Size 783KB
SHA256 e24b0253f243cd78d9730397423213cbcdbd7a13df277edd85600d4a95f2277a
MD5 6396969ee6b3ca827e008ee8ff829d85
SHA1 5d5b2fe9f48807dae72f1345e4357b5c6684b402
SHA512 c8be44a434cfd07c366acf3fe5720bf3f151e84ae449ae3a37140b1e162694bff616bbc393a6c6cef7ab00b74522b4bbb86705df0393e6c90a6e080993c316c3
SSDEEP 12288:P888888ssYxN5LF0xgxTqUSTOD2psz+wQTt1CNb7GZ:P888888ss8yxETNZ29buxyZ
TLSH
T153052911B6A63513F46827324D6D46599335BE5A3F33E3873BD93DAAAA2E7C36C11300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3D2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\nss3D2F.tmp
Size 1.3MB
SHA256 b71f4c3e0b6fe9d731abf2b8974ef94c3ac78cb848b078c65cd8634ff2416ff2
MD5 4bd631f2e38514e6bfea11af4a399964
SHA1 2f29c4b8087ac0bb59332cbbb22dee79e992b9ca
SHA512 5d3bd58dba2b9535d051df7e02e721695468a91eca1110ca1fc6c802a58d410067c8ded5647c50a766b189ecd1d19169922812edcf0f75ca304651ee2cddf0f3
SSDEEP 24576:yI1888888ss8yxETNZ29buxydLonR6Y43l:yIR8NGbuxyg4V
TLSH
T1C465E509EA7155EFE8F513370C5D1AF9D261AB192B22E29F63C72C754B3A3D398202D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads