quasar | 707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7
submitted
28/07/2020, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New_Bank_Information.exe
Size 768KB
Sample200728-aaf5wse2b6
SHA256 707bb653348d222860771a6117aa869ab2a032f6cdfe0d29a251374462e59058
MD5 fb6d84ef009530fe590ff062bb674c6f
SHA1 9d4ac7c3db2d51fe71aa2249e228f5f5a4d54d4a
SHA512 acbb34c0122cb2e23443d344543f6d197bfd3399bc7a86cd78289b822f315fc2b001268fe71a8731e70ad1909fe9244c0731a525281180c80fab9c2334acb2ea
MD5 SHA1 SHA512

Score

10^/10

quasar spyware trojan upx

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Executes dropped EXE 3 IoCs

pid	Process
1920	svchost.exe
1952	svchost.exe
1152	svchost.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1072-2-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/1072-4-0x0000000000400000-0x00000000004D0000-memory.dmp	upx
behavioral1/memory/1072-5-0x0000000000400000-0x00000000004D0000-memory.dmp	upx

Drops startup file 18 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update.vbs	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
1072	New_Bank_Information.exe
1072	New_Bank_Information.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SubDir\svchost.exe	New_Bank_Information.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\svchost.exe	New_Bank_Information.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	svchost.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 1072	1612	New_Bank_Information.exe	25
PID 1920 set thread context of 1952	1920	svchost.exe	32
PID 1840 set thread context of 1644	1840	New_Bank_Information.exe	36
PID 784 set thread context of 892	784	New_Bank_Information.exe	42
PID 1924 set thread context of 676	1924	New_Bank_Information.exe	46
PID 1916 set thread context of 1828	1916	New_Bank_Information.exe	50
PID 1140 set thread context of 1132	1140	New_Bank_Information.exe	54
PID 1516 set thread context of 1368	1516	New_Bank_Information.exe	58
PID 1416 set thread context of 1888	1416	New_Bank_Information.exe	62
PID 1948 set thread context of 628	1948	New_Bank_Information.exe	66
PID 1088 set thread context of 1608	1088	New_Bank_Information.exe	70
PID 268 set thread context of 580	268	New_Bank_Information.exe	74
PID 1648 set thread context of 1960	1648	New_Bank_Information.exe	78
PID 2020 set thread context of 828	2020	New_Bank_Information.exe	82
PID 1076 set thread context of 1448	1076	New_Bank_Information.exe	86
PID 1692 set thread context of 588	1692	New_Bank_Information.exe	90
PID 1660 set thread context of 1640	1660	New_Bank_Information.exe	94
PID 836 set thread context of 1540	836	New_Bank_Information.exe	98
PID 1912 set thread context of 1936	1912	New_Bank_Information.exe	102
PID 1884 set thread context of 240	1884	New_Bank_Information.exe	106
PID 1516 set thread context of 112	1516	New_Bank_Information.exe	110
PID 1384 set thread context of 860	1384	New_Bank_Information.exe	114
PID 1700 set thread context of 1644	1700	New_Bank_Information.exe	118
PID 1496 set thread context of 2004	1496	New_Bank_Information.exe	122
PID 528 set thread context of 1500	528	New_Bank_Information.exe	126
PID 1932 set thread context of 1372	1932	New_Bank_Information.exe	130
PID 1560 set thread context of 956	1560	New_Bank_Information.exe	134
PID 1528 set thread context of 1316	1528	New_Bank_Information.exe	138
PID 584 set thread context of 108	584	New_Bank_Information.exe	142
PID 1164 set thread context of 1972	1164	New_Bank_Information.exe	146
PID 1304 set thread context of 1332	1304	New_Bank_Information.exe	150
PID 828 set thread context of 1540	828	New_Bank_Information.exe	154
PID 628 set thread context of 1176	628	New_Bank_Information.exe	158
PID 1528 set thread context of 1056	1528	New_Bank_Information.exe	162
PID 328 set thread context of 2004	328	New_Bank_Information.exe	166
PID 1932 set thread context of 1984	1932	New_Bank_Information.exe	172
PID 1784 set thread context of 1768	1784	New_Bank_Information.exe	176
PID 2064 set thread context of 2092	2064	New_Bank_Information.exe	180
PID 2192 set thread context of 2220	2192	New_Bank_Information.exe	184
PID 2332 set thread context of 2360	2332	New_Bank_Information.exe	188
PID 2464 set thread context of 2492	2464	New_Bank_Information.exe	192
PID 2660 set thread context of 2688	2660	New_Bank_Information.exe	197
PID 2796 set thread context of 2824	2796	New_Bank_Information.exe	201
PID 2924 set thread context of 2952	2924	New_Bank_Information.exe	205
PID 3052 set thread context of 1480	3052	New_Bank_Information.exe	209
PID 2128 set thread context of 2144	2128	New_Bank_Information.exe	213
PID 2268 set thread context of 2304	2268	New_Bank_Information.exe	217
PID 2392 set thread context of 1996	2392	New_Bank_Information.exe	221
PID 2528 set thread context of 2552	2528	New_Bank_Information.exe	225
PID 2664 set thread context of 2740	2664	New_Bank_Information.exe	229
PID 2796 set thread context of 2872	2796	New_Bank_Information.exe	233
PID 2996 set thread context of 3048	2996	New_Bank_Information.exe	237
PID 3068 set thread context of 480	3068	New_Bank_Information.exe	241
PID 2180 set thread context of 2264	2180	New_Bank_Information.exe	245
PID 2324 set thread context of 2340	2324	New_Bank_Information.exe	249
PID 2364 set thread context of 2472	2364	New_Bank_Information.exe	253
PID 2652 set thread context of 2556	2652	New_Bank_Information.exe	257
PID 2708 set thread context of 2744	2708	New_Bank_Information.exe	261
PID 2876 set thread context of 3036	2876	New_Bank_Information.exe	265
PID 2072 set thread context of 2076	2072	New_Bank_Information.exe	269
PID 2144 set thread context of 2308	2144	New_Bank_Information.exe	273
PID 2376 set thread context of 2432	2376	New_Bank_Information.exe	277
PID 1552 set thread context of 2572	1552	New_Bank_Information.exe	281
PID 2720 set thread context of 2692	2720	New_Bank_Information.exe	285

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1884	schtasks.exe
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1612	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1060	New_Bank_Information.exe
1920	svchost.exe
1060	New_Bank_Information.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1840	New_Bank_Information.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe
1152	svchost.exe
1656	New_Bank_Information.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1612	New_Bank_Information.exe
1920	svchost.exe
1840	New_Bank_Information.exe
784	New_Bank_Information.exe
1924	New_Bank_Information.exe
1916	New_Bank_Information.exe
1140	New_Bank_Information.exe
1516	New_Bank_Information.exe
1416	New_Bank_Information.exe
1948	New_Bank_Information.exe
1088	New_Bank_Information.exe
268	New_Bank_Information.exe
1648	New_Bank_Information.exe
2020	New_Bank_Information.exe
1076	New_Bank_Information.exe
1692	New_Bank_Information.exe
1660	New_Bank_Information.exe
836	New_Bank_Information.exe
1912	New_Bank_Information.exe
1884	New_Bank_Information.exe
1516	New_Bank_Information.exe
1384	New_Bank_Information.exe
1700	New_Bank_Information.exe
1496	New_Bank_Information.exe
528	New_Bank_Information.exe
1932	New_Bank_Information.exe
1560	New_Bank_Information.exe
1528	New_Bank_Information.exe
584	New_Bank_Information.exe
1164	New_Bank_Information.exe
1304	New_Bank_Information.exe
828	New_Bank_Information.exe
628	New_Bank_Information.exe
1528	New_Bank_Information.exe
328	New_Bank_Information.exe
1932	New_Bank_Information.exe
1784	New_Bank_Information.exe
2064	New_Bank_Information.exe
2192	New_Bank_Information.exe
2332	New_Bank_Information.exe
2464	New_Bank_Information.exe
2660	New_Bank_Information.exe
2796	New_Bank_Information.exe
2924	New_Bank_Information.exe
3052	New_Bank_Information.exe
2128	New_Bank_Information.exe
2268	New_Bank_Information.exe
2392	New_Bank_Information.exe
2528	New_Bank_Information.exe
2664	New_Bank_Information.exe
2796	New_Bank_Information.exe
2996	New_Bank_Information.exe
3068	New_Bank_Information.exe
2180	New_Bank_Information.exe
2324	New_Bank_Information.exe
2364	New_Bank_Information.exe
2652	New_Bank_Information.exe
2708	New_Bank_Information.exe
2876	New_Bank_Information.exe
2072	New_Bank_Information.exe
2144	New_Bank_Information.exe
2376	New_Bank_Information.exe
1552	New_Bank_Information.exe
2720	New_Bank_Information.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	New_Bank_Information.exe
Token: SeDebugPrivilege	1952	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 364	1612	New_Bank_Information.exe	24
PID 1612 wrote to memory of 364	1612	New_Bank_Information.exe	24
PID 1612 wrote to memory of 364	1612	New_Bank_Information.exe	24
PID 1612 wrote to memory of 364	1612	New_Bank_Information.exe	24
PID 1612 wrote to memory of 364	1612	New_Bank_Information.exe	24
PID 1612 wrote to memory of 364	1612	New_Bank_Information.exe	24
PID 1612 wrote to memory of 1072	1612	New_Bank_Information.exe	25
PID 1612 wrote to memory of 1072	1612	New_Bank_Information.exe	25
PID 1612 wrote to memory of 1072	1612	New_Bank_Information.exe	25
PID 1612 wrote to memory of 1072	1612	New_Bank_Information.exe	25
PID 1612 wrote to memory of 1060	1612	New_Bank_Information.exe	26
PID 1612 wrote to memory of 1060	1612	New_Bank_Information.exe	26
PID 1612 wrote to memory of 1060	1612	New_Bank_Information.exe	26
PID 1612 wrote to memory of 1060	1612	New_Bank_Information.exe	26
PID 1072 wrote to memory of 1884	1072	New_Bank_Information.exe	28
PID 1072 wrote to memory of 1884	1072	New_Bank_Information.exe	28
PID 1072 wrote to memory of 1884	1072	New_Bank_Information.exe	28
PID 1072 wrote to memory of 1884	1072	New_Bank_Information.exe	28
PID 1072 wrote to memory of 1920	1072	New_Bank_Information.exe	30
PID 1072 wrote to memory of 1920	1072	New_Bank_Information.exe	30
PID 1072 wrote to memory of 1920	1072	New_Bank_Information.exe	30
PID 1072 wrote to memory of 1920	1072	New_Bank_Information.exe	30
PID 1920 wrote to memory of 1944	1920	svchost.exe	31
PID 1920 wrote to memory of 1944	1920	svchost.exe	31
PID 1920 wrote to memory of 1944	1920	svchost.exe	31
PID 1920 wrote to memory of 1944	1920	svchost.exe	31
PID 1920 wrote to memory of 1944	1920	svchost.exe	31
PID 1920 wrote to memory of 1944	1920	svchost.exe	31
PID 1920 wrote to memory of 1952	1920	svchost.exe	32
PID 1920 wrote to memory of 1952	1920	svchost.exe	32
PID 1920 wrote to memory of 1952	1920	svchost.exe	32
PID 1920 wrote to memory of 1952	1920	svchost.exe	32
PID 1920 wrote to memory of 1152	1920	svchost.exe	33
PID 1920 wrote to memory of 1152	1920	svchost.exe	33
PID 1920 wrote to memory of 1152	1920	svchost.exe	33
PID 1920 wrote to memory of 1152	1920	svchost.exe	33
PID 1060 wrote to memory of 1840	1060	New_Bank_Information.exe	34
PID 1060 wrote to memory of 1840	1060	New_Bank_Information.exe	34
PID 1060 wrote to memory of 1840	1060	New_Bank_Information.exe	34
PID 1060 wrote to memory of 1840	1060	New_Bank_Information.exe	34
PID 1840 wrote to memory of 1764	1840	New_Bank_Information.exe	35
PID 1840 wrote to memory of 1764	1840	New_Bank_Information.exe	35
PID 1840 wrote to memory of 1764	1840	New_Bank_Information.exe	35
PID 1840 wrote to memory of 1764	1840	New_Bank_Information.exe	35
PID 1840 wrote to memory of 1764	1840	New_Bank_Information.exe	35
PID 1840 wrote to memory of 1764	1840	New_Bank_Information.exe	35
PID 1840 wrote to memory of 1644	1840	New_Bank_Information.exe	36
PID 1840 wrote to memory of 1644	1840	New_Bank_Information.exe	36
PID 1840 wrote to memory of 1644	1840	New_Bank_Information.exe	36
PID 1840 wrote to memory of 1644	1840	New_Bank_Information.exe	36
PID 1840 wrote to memory of 1656	1840	New_Bank_Information.exe	37
PID 1840 wrote to memory of 1656	1840	New_Bank_Information.exe	37
PID 1840 wrote to memory of 1656	1840	New_Bank_Information.exe	37
PID 1840 wrote to memory of 1656	1840	New_Bank_Information.exe	37
PID 1952 wrote to memory of 1424	1952	svchost.exe	38
PID 1952 wrote to memory of 1424	1952	svchost.exe	38
PID 1952 wrote to memory of 1424	1952	svchost.exe	38
PID 1952 wrote to memory of 1424	1952	svchost.exe	38
PID 1656 wrote to memory of 784	1656	New_Bank_Information.exe	40
PID 1656 wrote to memory of 784	1656	New_Bank_Information.exe	40
PID 1656 wrote to memory of 784	1656	New_Bank_Information.exe	40
PID 1656 wrote to memory of 784	1656	New_Bank_Information.exe	40
PID 784 wrote to memory of 324	784	New_Bank_Information.exe	41
PID 784 wrote to memory of 324	784	New_Bank_Information.exe	41

C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
"C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:364
- C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1884
- - C:\Windows\SysWOW64\SubDir\svchost.exe
    "C:\Windows\SysWOW64\SubDir\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\SubDir\svchost.exe
      "C:\Windows\SysWOW64\SubDir\svchost.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Java Update" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\svchost.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1424
  - - C:\Windows\SysWOW64\SubDir\svchost.exe
      "C:\Windows\SysWOW64\SubDir\svchost.exe" 2 1952 69950
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1152
- C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
  "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1072 66409
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
    "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
      "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
      4⤵
      PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
      "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1644 70590
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:784
      - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        6⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 892 72446
        6⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1924
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        8⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 676 74069
        8⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        9⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1916
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:1048
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        10⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1828 75629
        10⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        11⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1140
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        12⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1132 77204
        12⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        13⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1516
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        14⤵
        Drops startup file
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        14⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1368 78671
        14⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        15⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1416
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        16⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        16⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1888 80106
        16⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        17⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1948
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        18⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        18⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 628 81666
        18⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        19⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1088
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        20⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        20⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1608 83195
        20⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        21⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:268
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        22⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        22⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 580 84739
        22⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        23⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1648
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        24⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        24⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1960 86174
        24⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        25⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2020
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        26⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        26⤵
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 828 87641
        26⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        27⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1076
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        28⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        28⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1448 89154
        28⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        29⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1692
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        30⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        30⤵
        
        PID:588
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 588 90558
        30⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        31⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1660
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        32⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        32⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1640 92024
        32⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        33⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:836
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        34⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        34⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1540 93460
        34⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        35⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1912
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        36⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        36⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1936 94957
        36⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        37⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1884
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        38⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        38⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 240 96471
        38⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        39⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1516
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        40⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        40⤵
        
        PID:112
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 112 97765
        40⤵
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        41⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1384
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        42⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        42⤵
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 860 99294
        42⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        43⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1700
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        44⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        44⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1644 100667
        44⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        45⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1496
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        46⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        46⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2004 102196
        46⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        47⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:528
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        48⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        48⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1500 103787
        48⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        49⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1932
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        50⤵
        Drops startup file
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        50⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1372 109777
        50⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        51⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1560
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        52⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        52⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 956 111275
        52⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        53⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1528
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        54⤵
        Drops startup file
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        54⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1316 112695
        54⤵
        
        PID:1892
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        55⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:584
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        56⤵
        Drops startup file
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        56⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 108 114161
        56⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        57⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1164
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        58⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        58⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1972 115627
        58⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        59⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1304
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        60⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        60⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1332 117125
        60⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        61⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:828
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        62⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        62⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1540 118638
        62⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        63⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:628
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        64⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        64⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1176 120183
        64⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        65⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1528
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        66⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        66⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1056 121665
        66⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        67⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:328
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        68⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        68⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2004 123069
        68⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        69⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1932
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        70⤵
        Drops startup file
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        70⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1984 124582
        70⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        71⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1784
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        72⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        72⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1768 126173
        72⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        73⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2064
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        74⤵
        Drops startup file
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        74⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2092 127577
        74⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        75⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2192
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        76⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        76⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2220 129075
        76⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        77⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2332
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        78⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        78⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2360 130463
        78⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        79⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2464
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        80⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        80⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2492 132008
        80⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        81⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2660
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        82⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        82⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2688 133474
        82⤵
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        83⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2796
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        84⤵
        Drops startup file
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        84⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2824 135081
        84⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        85⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2924
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        86⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        86⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2952 136797
        86⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        87⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3052
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        88⤵
        Drops startup file
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        88⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1480 138294
        88⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        89⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2128
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        90⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        90⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2144 139792
        90⤵
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        91⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2268
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        92⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        92⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2304 141305
        92⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        93⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2392
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        94⤵
        Drops startup file
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        94⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1996 142834
        94⤵
        
        PID:2420
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        95⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2528
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        96⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        96⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2552 144363
        96⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        97⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2664
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        98⤵
        Drops startup file
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        98⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2740 145845
        98⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        99⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2796
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        100⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        100⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2872 147342
        100⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        101⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2996
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        102⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        102⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 3048 148996
        102⤵
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        103⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:3068
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        104⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        104⤵
        
        PID:480
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 480 150572
        104⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        105⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2180
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        106⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        106⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2264 152022
        106⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        107⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2324
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        108⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        108⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2340 153520
        108⤵
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        109⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2364
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        110⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        110⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2472 155142
        110⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        111⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2652
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        112⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        112⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2556 156687
        112⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        113⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2708
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        114⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        114⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2744 158185
        114⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        115⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2876
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        116⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        116⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 3036 159635
        116⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        117⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2072
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        118⤵
        Drops startup file
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        118⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2076 161133
        118⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        119⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2144
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        120⤵
        Drops startup file
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        120⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2308 162599
        120⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        121⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2376
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        122⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        122⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2432 164128
        122⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        123⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:1552
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        124⤵
        Drops startup file
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        124⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2572 165673
        124⤵
        
        PID:2640
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        125⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2720
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        126⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        126⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2692 167123
        126⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        127⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        128⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        128⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2888 168637
        128⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        129⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        130⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        130⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2120 170072
        130⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        131⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        132⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        132⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2164 171429
        132⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        133⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        134⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        134⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2408 172973
        134⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        135⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        136⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        136⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1572 174549
        136⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        137⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        138⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        138⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2916 176093
        138⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        139⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        140⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        140⤵
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1532 177591
        140⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        141⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        142⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        142⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1480 179073
        142⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        143⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        144⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        144⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1240 180727
        144⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        145⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        146⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        146⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2764 182240
        146⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        147⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        148⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        148⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 3056 183784
        148⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        149⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        150⤵
        Drops startup file
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        150⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2176 185375
        150⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        151⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        152⤵
        Drops startup file
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        152⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2144 186857
        152⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        153⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        154⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        154⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2468 188355
        154⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        155⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        156⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        156⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2928 189822
        156⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        157⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        158⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        158⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 3036 191179
        158⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        159⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        160⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        160⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2388 192786
        160⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        161⤵
        
        PID:920
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        162⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        162⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2788 194252
        162⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        163⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        164⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        164⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 3056 195718
        164⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        165⤵
        
        PID:760
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        166⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        166⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2236 197122
        166⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        167⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        168⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        168⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2740 198636
        168⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        169⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        170⤵
        Drops startup file
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        170⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2100 200118
        170⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        171⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        172⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        172⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1704 201756
        172⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        173⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        174⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        174⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2984 203238
        174⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        175⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        176⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        176⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1812 204813
        176⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        177⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        178⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        178⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2932 206248
        178⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        179⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        180⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        180⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2740 207684
        180⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        181⤵
        
        PID:340
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        182⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        182⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 540 209322
        182⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        183⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        184⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        184⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2552 210928
        184⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        185⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        186⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        186⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 580 212504
        186⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        187⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        188⤵
        Drops startup file
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        188⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 2868 214064
        188⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        189⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        190⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe"
        190⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe
        
        "C:\Users\Admin\AppData\Local\Temp\New_Bank_Information.exe" 2 1040 215530
        190⤵
        
        PID:3024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-354-0x0000000000292000-0x0000000000293000-memory.dmp

Download

memory/108-353-0x0000000001E70000-0x0000000001ED2000-memory.dmp

Download

memory/112-257-0x00000000002B2000-0x00000000002B3000-memory.dmp

Download

memory/240-245-0x0000000001C92000-0x0000000001C93000-memory.dmp

Download

memory/364-1-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/480-645-0x0000000000322000-0x0000000000323000-memory.dmp

Download

memory/540-1117-0x0000000000232000-0x0000000000233000-memory.dmp

Download

memory/580-149-0x0000000001F82000-0x0000000001F83000-memory.dmp

Download

memory/588-195-0x0000000000540000-0x00000000005A2000-memory.dmp

Download

memory/588-197-0x0000000002002000-0x0000000002003000-memory.dmp

Download

memory/628-125-0x0000000001FE2000-0x0000000001FE3000-memory.dmp

Download

memory/628-124-0x0000000000570000-0x00000000005D2000-memory.dmp

Download

memory/676-63-0x0000000001E10000-0x0000000001E72000-memory.dmp

Download

memory/676-64-0x0000000000612000-0x0000000000613000-memory.dmp

Download

memory/828-173-0x00000000003D2000-0x00000000003D3000-memory.dmp

Download

memory/860-268-0x0000000001CF0000-0x0000000001D52000-memory.dmp

Download

memory/860-269-0x0000000001E22000-0x0000000001E23000-memory.dmp

Download

memory/892-51-0x0000000001D10000-0x0000000001D72000-memory.dmp

Download

memory/892-52-0x0000000001DB2000-0x0000000001DB3000-memory.dmp

Download

memory/956-329-0x00000000005E2000-0x00000000005E3000-memory.dmp

Download

memory/956-328-0x0000000000530000-0x0000000000592000-memory.dmp

Download

memory/1040-1166-0x0000000000252000-0x0000000000253000-memory.dmp

Download

memory/1056-414-0x0000000000862000-0x0000000000863000-memory.dmp

Download

memory/1072-2-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1072-4-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1072-5-0x0000000000400000-0x00000000004D0000-memory.dmp

Download

memory/1072-7-0x00000000004D0000-0x0000000000532000-memory.dmp

Download

memory/1072-8-0x00000000002D2000-0x00000000002D3000-memory.dmp

Download

memory/1072-9-0x0000000000300000-0x000000000035C000-memory.dmp

Download

memory/1132-88-0x0000000002022000-0x0000000002023000-memory.dmp

Download

memory/1132-87-0x00000000007B0000-0x0000000000812000-memory.dmp

Download

memory/1176-402-0x0000000000372000-0x0000000000373000-memory.dmp

Download

memory/1240-887-0x00000000002A2000-0x00000000002A3000-memory.dmp

Download

memory/1316-340-0x0000000001DB0000-0x0000000001E12000-memory.dmp

Download

memory/1316-341-0x0000000001EA2000-0x0000000001EA3000-memory.dmp

Download

memory/1332-377-0x0000000000380000-0x00000000003E2000-memory.dmp

Download

memory/1332-378-0x0000000001E72000-0x0000000001E73000-memory.dmp

Download

memory/1368-99-0x0000000000370000-0x00000000003D2000-memory.dmp

Download

memory/1368-100-0x0000000002122000-0x0000000002123000-memory.dmp

Download

memory/1372-317-0x0000000001F92000-0x0000000001F93000-memory.dmp

Download

memory/1372-316-0x0000000000330000-0x0000000000392000-memory.dmp

Download

memory/1448-185-0x0000000002042000-0x0000000002043000-memory.dmp

Download

memory/1480-547-0x0000000000A10000-0x0000000000A72000-memory.dmp

Download

memory/1480-548-0x00000000008E2000-0x00000000008E3000-memory.dmp

Download

memory/1480-875-0x0000000000322000-0x0000000000323000-memory.dmp

Download

memory/1500-305-0x0000000000312000-0x0000000000313000-memory.dmp

Download

memory/1532-863-0x0000000000582000-0x0000000000583000-memory.dmp

Download

memory/1540-221-0x00000000002A2000-0x00000000002A3000-memory.dmp

Download

memory/1572-838-0x0000000001DD0000-0x0000000001E32000-memory.dmp

Download

memory/1572-839-0x0000000001E62000-0x0000000001E63000-memory.dmp

Download

memory/1608-137-0x0000000000352000-0x0000000000353000-memory.dmp

Download

memory/1640-209-0x0000000000242000-0x0000000000243000-memory.dmp

Download

memory/1644-38-0x0000000000520000-0x0000000000582000-memory.dmp

Download

memory/1644-281-0x0000000001F52000-0x0000000001F53000-memory.dmp

Download

memory/1644-39-0x0000000001FA2000-0x0000000001FA3000-memory.dmp

Download

memory/1704-1057-0x0000000001E72000-0x0000000001E73000-memory.dmp

Download

memory/1704-1056-0x0000000001D00000-0x0000000001D62000-memory.dmp

Download

memory/1768-451-0x0000000001FF2000-0x0000000001FF3000-memory.dmp

Download

memory/1812-1081-0x0000000000292000-0x0000000000293000-memory.dmp

Download

memory/1828-76-0x0000000001F12000-0x0000000001F13000-memory.dmp

Download

memory/1888-113-0x0000000000232000-0x0000000000233000-memory.dmp

Download

memory/1888-112-0x00000000004D0000-0x0000000000532000-memory.dmp

Download

memory/1936-233-0x0000000000622000-0x0000000000623000-memory.dmp

Download

memory/1936-232-0x00000000005A0000-0x0000000000602000-memory.dmp

Download

memory/1952-28-0x00000000007C2000-0x00000000007C3000-memory.dmp

Download

memory/1952-26-0x0000000000390000-0x00000000003F2000-memory.dmp

Download

memory/1960-161-0x00000000002C2000-0x00000000002C3000-memory.dmp

Download

memory/1972-366-0x0000000000252000-0x0000000000253000-memory.dmp

Download

memory/1984-439-0x0000000001FD2000-0x0000000001FD3000-memory.dmp

Download

memory/1996-585-0x0000000001FA2000-0x0000000001FA3000-memory.dmp

Download

memory/2004-426-0x0000000001CB2000-0x0000000001CB3000-memory.dmp

Download

memory/2004-293-0x0000000002042000-0x0000000002043000-memory.dmp

Download

memory/2004-425-0x0000000001E80000-0x0000000001EE2000-memory.dmp

Download

memory/2076-729-0x00000000002A2000-0x00000000002A3000-memory.dmp

Download

memory/2092-463-0x0000000001F02000-0x0000000001F03000-memory.dmp

Download

memory/2100-1045-0x00000000005C2000-0x00000000005C3000-memory.dmp

Download

memory/2120-803-0x0000000000262000-0x0000000000263000-memory.dmp

Download

memory/2144-935-0x00000000005A2000-0x00000000005A3000-memory.dmp

Download

memory/2144-560-0x0000000000292000-0x0000000000293000-memory.dmp

Download

memory/2164-815-0x00000000002E2000-0x00000000002E3000-memory.dmp

Download

memory/2176-922-0x0000000000550000-0x00000000005B2000-memory.dmp

Download

memory/2176-923-0x0000000002022000-0x0000000002023000-memory.dmp

Download

memory/2220-475-0x00000000002F2000-0x00000000002F3000-memory.dmp

Download

memory/2236-1020-0x0000000000232000-0x0000000000233000-memory.dmp

Download

memory/2264-657-0x0000000000272000-0x0000000000273000-memory.dmp

Download

memory/2304-572-0x0000000001F72000-0x0000000001F73000-memory.dmp

Download

memory/2308-742-0x00000000002C2000-0x00000000002C3000-memory.dmp

Download

memory/2308-741-0x0000000001D60000-0x0000000001DC2000-memory.dmp

Download

memory/2340-668-0x0000000001DC0000-0x0000000001E22000-memory.dmp

Download

memory/2340-669-0x00000000003A2000-0x00000000003A3000-memory.dmp

Download

memory/2360-487-0x0000000001F32000-0x0000000001F33000-memory.dmp

Download

memory/2388-984-0x0000000001E92000-0x0000000001E93000-memory.dmp

Download

memory/2408-827-0x0000000001F22000-0x0000000001F23000-memory.dmp

Download

memory/2432-754-0x0000000001F32000-0x0000000001F33000-memory.dmp

Download

memory/2468-948-0x0000000001F82000-0x0000000001F83000-memory.dmp

Download

memory/2472-681-0x0000000002052000-0x0000000002053000-memory.dmp

Download

memory/2492-499-0x00000000003F2000-0x00000000003F3000-memory.dmp

Download

memory/2552-597-0x0000000001E92000-0x0000000001E93000-memory.dmp

Download

memory/2552-596-0x0000000001D20000-0x0000000001D82000-memory.dmp

Download

memory/2552-1128-0x00000000006D0000-0x0000000000732000-memory.dmp

Download

memory/2556-693-0x00000000002B2000-0x00000000002B3000-memory.dmp

Download

memory/2572-766-0x0000000000232000-0x0000000000233000-memory.dmp

Download

memory/2688-511-0x0000000000592000-0x0000000000593000-memory.dmp

Download

memory/2692-779-0x0000000000242000-0x0000000000243000-memory.dmp

Download

memory/2740-1104-0x0000000001D40000-0x0000000001DA2000-memory.dmp

Download

memory/2740-1031-0x0000000001D30000-0x0000000001D92000-memory.dmp

Download

memory/2740-1032-0x00000000002D2000-0x00000000002D3000-memory.dmp

Download

memory/2740-1105-0x00000000005E2000-0x00000000005E3000-memory.dmp

Download

memory/2740-609-0x0000000002002000-0x0000000002003000-memory.dmp

Download

memory/2744-705-0x0000000000292000-0x0000000000293000-memory.dmp

Download

memory/2744-704-0x00000000005D0000-0x0000000000632000-memory.dmp

Download

memory/2764-899-0x0000000001FF2000-0x0000000001FF3000-memory.dmp

Download

memory/2788-996-0x0000000001D22000-0x0000000001D23000-memory.dmp

Download

memory/2824-522-0x0000000001D90000-0x0000000001DF2000-memory.dmp

Download

memory/2824-523-0x0000000001F02000-0x0000000001F03000-memory.dmp

Download

memory/2868-1154-0x0000000000282000-0x0000000000283000-memory.dmp

Download

memory/2872-621-0x0000000001CD2000-0x0000000001CD3000-memory.dmp

Download

memory/2872-620-0x0000000001DA0000-0x0000000001E02000-memory.dmp

Download

memory/2888-791-0x0000000000312000-0x0000000000313000-memory.dmp

Download

memory/2888-790-0x0000000001D80000-0x0000000001DE2000-memory.dmp

Download

memory/2916-851-0x0000000000232000-0x0000000000233000-memory.dmp

Download

memory/2928-959-0x0000000001CD0000-0x0000000001D32000-memory.dmp

Download

memory/2928-960-0x0000000001D92000-0x0000000001D93000-memory.dmp

Download

memory/2932-1093-0x0000000001F12000-0x0000000001F13000-memory.dmp

Download

memory/2952-536-0x0000000001F22000-0x0000000001F23000-memory.dmp

Download

memory/2952-535-0x00000000005B0000-0x0000000000612000-memory.dmp

Download

memory/2984-1069-0x0000000001F32000-0x0000000001F33000-memory.dmp

Download

memory/3036-972-0x0000000001E52000-0x0000000001E53000-memory.dmp

Download

memory/3036-717-0x0000000000272000-0x0000000000273000-memory.dmp

Download

memory/3036-971-0x0000000001C90000-0x0000000001CF2000-memory.dmp

Download

memory/3048-633-0x00000000003D2000-0x00000000003D3000-memory.dmp

Download

memory/3056-911-0x0000000001DA2000-0x0000000001DA3000-memory.dmp

Download

memory/3056-1008-0x0000000000292000-0x0000000000293000-memory.dmp

Download