958d11fc5291780b66ed6888cdcc17d9b63986232e7bf098d44d5b2afeefe8c6

Analysis

max time kernel
88s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b48f3eca56819fe3b543670b918b3c9_JC.exe
Size

1.4MB
MD5

1b48f3eca56819fe3b543670b918b3c9
SHA1

992fa0997ccad73224130c84e33116f7b9716cd0
SHA256

958d11fc5291780b66ed6888cdcc17d9b63986232e7bf098d44d5b2afeefe8c6
SHA512

6fcaddc97e07b34b568d1f9b37eeed289d0dbfec0b1f4052f8a0d6b807a2bb81de6511bdfe5123a09d73a5a0247dafb6428397eb215f1a4e45c49302a969ea52
SSDEEP

24576:oWNVe227AUng/qJicU+sQZPXBFYuJnKw1KKTWkJ8Z8u6FidvWCY10z:V+FAUOkUMNXzxnJgU66c1WCY10z

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	1b48f3eca56819fe3b543670b918b3c9_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	1b48f3eca56819fe3b543670b918b3c9_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	1b48f3eca56819fe3b543670b918b3c9_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	1b48f3eca56819fe3b543670b918b3c9_JC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	1b48f3eca56819fe3b543670b918b3c9_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\K:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\N:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\P:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\R:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\T:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\Z:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\B:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\I:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\L:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\S:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\V:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\W:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\G:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\M:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\O:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\X:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\A:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\E:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\J:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\Q:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\U:	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File opened (read-only)	\??\Y:	1b48f3eca56819fe3b543670b918b3c9_JC.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Templates\french bukkake trambling girls swallow .rar.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\black horse gay [free] balls (Liz).rar.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\brasilian handjob gay hidden .mpg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\xxx public high heels (Liz).zip.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Microsoft\Temp\asian trambling bukkake several models nipples (Sandy).mpg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\african xxx animal uncut circumcision .mpeg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\animal beast full movie young (Karin).rar.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\animal nude licking (Janette,Kathrin).mpeg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\american porn [free] high heels .mpeg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\danish sperm hot (!) young .rar.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\kicking fucking hot (!) young .avi.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\fetish masturbation beautyfull .avi.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\swedish fucking cum public (Janette).mpeg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\xxx cum voyeur legs .mpg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files (x86)\Google\Temp\german blowjob hidden titts .mpg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\african trambling horse [bangbus] wifey .avi.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\african handjob girls swallow .mpg.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	1b48f3eca56819fe3b543670b918b3c9_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe
2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe
4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3412	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3412	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe
2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe
664	1b48f3eca56819fe3b543670b918b3c9_JC.exe
664	1b48f3eca56819fe3b543670b918b3c9_JC.exe
728	1b48f3eca56819fe3b543670b918b3c9_JC.exe
728	1b48f3eca56819fe3b543670b918b3c9_JC.exe
4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe
4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe
2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe
2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe
3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2688	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	87
PID 3352 wrote to memory of 2688	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	87
PID 3352 wrote to memory of 2688	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	87
PID 3352 wrote to memory of 4748	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	89
PID 3352 wrote to memory of 4748	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	89
PID 3352 wrote to memory of 4748	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	89
PID 2688 wrote to memory of 3412	2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe	90
PID 2688 wrote to memory of 3412	2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe	90
PID 2688 wrote to memory of 3412	2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe	90
PID 3352 wrote to memory of 664	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	95
PID 3352 wrote to memory of 664	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	95
PID 3352 wrote to memory of 664	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	95
PID 2688 wrote to memory of 728	2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe	93
PID 2688 wrote to memory of 728	2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe	93
PID 2688 wrote to memory of 728	2688	1b48f3eca56819fe3b543670b918b3c9_JC.exe	93
PID 4748 wrote to memory of 5096	4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe	94
PID 4748 wrote to memory of 5096	4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe	94
PID 4748 wrote to memory of 5096	4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe	94
PID 3412 wrote to memory of 3892	3412	1b48f3eca56819fe3b543670b918b3c9_JC.exe	96
PID 3412 wrote to memory of 3892	3412	1b48f3eca56819fe3b543670b918b3c9_JC.exe	96
PID 3412 wrote to memory of 3892	3412	1b48f3eca56819fe3b543670b918b3c9_JC.exe	96
PID 4748 wrote to memory of 1056	4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe	99
PID 4748 wrote to memory of 1056	4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe	99
PID 4748 wrote to memory of 1056	4748	1b48f3eca56819fe3b543670b918b3c9_JC.exe	99
PID 3352 wrote to memory of 4284	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	100
PID 3352 wrote to memory of 4284	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	100
PID 3352 wrote to memory of 4284	3352	1b48f3eca56819fe3b543670b918b3c9_JC.exe	100

C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        8⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17440
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17180
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:19484
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17488
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17300
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:14552
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17588
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17156
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17552
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17740
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17684
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15268
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:11172
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:14416
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:16200
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17668
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17628
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16056
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17512
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17644
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:524
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:16324
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13572
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15764
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14972
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17124
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16072
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17604
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17132
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:100
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17756
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16208
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15708
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17196
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15948
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15532
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:16376
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:14812
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:10912
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:3832
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17660
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15144
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17544
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:428
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15664
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17228
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:14852
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17284
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15580
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17148
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14732
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15924
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17432
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:11988
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15176
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13852
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15312
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15168
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:14840
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:10784
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:3752
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:664
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        7⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17116
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16080
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17620
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15656
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17252
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        6⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:13528
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17580
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:1560
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15128
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15328
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:11148
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:14348
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:4284
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:14364
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:14288
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17764
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:14872
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:7008
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15516
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17260
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:15152
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:14696
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15204
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17140
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:11500
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:14688
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:5240
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17472
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
      4⤵
      PID:17612
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:13404
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:15916
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:17424
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:6216
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:10416
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:17792
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:7932
- - C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
    3⤵
    PID:14928
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:10904
- C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\1b48f3eca56819fe3b543670b918b3c9_JC.exe"
  2⤵
  PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\african trambling horse [bangbus] wifey .avi.exe

Filesize
362KB

MD5
4ac8fd8ce9ace92648e259ccbf768444

SHA1
59298de1153ed18455c59a6571111cedbdacba34

SHA256
358230719f94fb02e6597f0f35a349dec0ae53a44bcbe2ba5baec76546c5b04a

SHA512
88150719e7dbb976546d6088701894add8b6cefa9144c1b5a10f9d88d1b98bd51dded617bd67dbb3172bcc44bcf5786f8c00d5732c3599d515850938244da759

Download Submit
memory/100-160-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/664-45-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/728-53-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1056-96-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1200-99-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1320-106-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1556-120-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2496-168-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2764-101-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2952-165-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3136-167-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3316-171-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3352-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3412-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3756-102-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3868-158-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4284-97-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4312-156-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4504-164-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4716-166-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5096-57-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5240-172-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5308-173-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5392-174-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5412-176-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5540-195-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5544-180-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5596-189-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5604-181-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5612-182-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5632-183-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5712-184-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5732-190-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5772-185-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5840-191-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5848-186-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5924-192-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5936-187-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5972-193-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6020-188-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6104-194-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6204-217-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6216-196-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6228-197-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6340-198-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6360-218-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6432-199-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6548-200-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6556-201-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6648-202-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6796-203-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6940-204-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7008-205-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7016-206-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7112-207-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7120-208-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7128-209-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7136-210-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7224-211-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7236-212-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7244-213-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7252-214-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7260-215-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7616-216-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download