f6ef88d4e7d9db6085e1d64762cc01fc64bfd9cc632f228e84bd5f5038030589

Resubmissions

27-01-2024 20:09

240127-yw3qqachhq 7

20-12-2023 14:49

231220-r7aezsffdr 10

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd2fb1d044d414dcbf32bf67f2563208.exe
Size

2.3MB
MD5

cd2fb1d044d414dcbf32bf67f2563208
SHA1

98dae9d51bc1ee7d619a546550adc2e98113db17
SHA256

f6ef88d4e7d9db6085e1d64762cc01fc64bfd9cc632f228e84bd5f5038030589
SHA512

88a89c729f4edf3cb944de03bed2177cb9b2791de261bbdb15ebeceb075311ba9318abedfa8380a194062b048496f43c9a5bbfdf712f96a69aa4b5d80c1adbde
SSDEEP

49152:kloF0g3n0xTxvO0REE0zVeWbKr9P95upyQQoQxlyxBf9NGFzdCh:kloeO0e35NKpPrqyLo4ah9+Mh

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4788	cd2fb1d044d414dcbf32bf67f2563208.exe
4788	cd2fb1d044d414dcbf32bf67f2563208.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4788	cd2fb1d044d414dcbf32bf67f2563208.exe
4788	cd2fb1d044d414dcbf32bf67f2563208.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 2324	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	35
PID 4788 wrote to memory of 2324	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	35
PID 4788 wrote to memory of 2324	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	35
PID 4788 wrote to memory of 4784	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	251
PID 4788 wrote to memory of 4784	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	251
PID 4788 wrote to memory of 4784	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	251
PID 4788 wrote to memory of 5040	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	250
PID 4788 wrote to memory of 5040	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	250
PID 4788 wrote to memory of 5040	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	250
PID 4788 wrote to memory of 5000	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	249
PID 4788 wrote to memory of 5000	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	249
PID 4788 wrote to memory of 5000	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	249
PID 4788 wrote to memory of 3744	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	248
PID 4788 wrote to memory of 3744	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	248
PID 4788 wrote to memory of 3744	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	248
PID 4788 wrote to memory of 4384	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	247
PID 4788 wrote to memory of 4384	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	247
PID 4788 wrote to memory of 4384	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	247
PID 4788 wrote to memory of 1696	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	246
PID 4788 wrote to memory of 1696	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	246
PID 4788 wrote to memory of 1696	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	246
PID 4788 wrote to memory of 4496	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	245
PID 4788 wrote to memory of 4496	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	245
PID 4788 wrote to memory of 4496	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	245
PID 4788 wrote to memory of 3896	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	244
PID 4788 wrote to memory of 3896	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	244
PID 4788 wrote to memory of 3896	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	244
PID 4788 wrote to memory of 1880	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	243
PID 4788 wrote to memory of 1880	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	243
PID 4788 wrote to memory of 1880	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	243
PID 4788 wrote to memory of 2664	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	242
PID 4788 wrote to memory of 2664	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	242
PID 4788 wrote to memory of 2664	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	242
PID 4788 wrote to memory of 3148	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	241
PID 4788 wrote to memory of 3148	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	241
PID 4788 wrote to memory of 3148	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	241
PID 4788 wrote to memory of 1672	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	240
PID 4788 wrote to memory of 1672	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	240
PID 4788 wrote to memory of 1672	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	240
PID 4788 wrote to memory of 4448	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	239
PID 4788 wrote to memory of 4448	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	239
PID 4788 wrote to memory of 4448	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	239
PID 4788 wrote to memory of 1440	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	238
PID 4788 wrote to memory of 1440	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	238
PID 4788 wrote to memory of 1440	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	238
PID 4788 wrote to memory of 1144	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	237
PID 4788 wrote to memory of 1144	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	237
PID 4788 wrote to memory of 1144	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	237
PID 4788 wrote to memory of 3752	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	236
PID 4788 wrote to memory of 3752	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	236
PID 4788 wrote to memory of 3752	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	236
PID 4788 wrote to memory of 3424	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	235
PID 4788 wrote to memory of 3424	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	235
PID 4788 wrote to memory of 3424	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	235
PID 4788 wrote to memory of 4084	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	234
PID 4788 wrote to memory of 4084	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	234
PID 4788 wrote to memory of 4084	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	234
PID 4788 wrote to memory of 1556	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	233
PID 4788 wrote to memory of 1556	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	233
PID 4788 wrote to memory of 1556	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	233
PID 4788 wrote to memory of 3256	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	232
PID 4788 wrote to memory of 3256	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	232
PID 4788 wrote to memory of 3256	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	232
PID 4788 wrote to memory of 3616	4788	cd2fb1d044d414dcbf32bf67f2563208.exe	231

C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
"C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"
  2⤵
  - Drops startup file
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5276
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5468
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5460
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5452
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5444
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5428
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5420
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5412
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5404
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5396
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5388
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5380
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5372
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5364
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5356
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5348
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5340
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5324
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5308
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5300
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5292
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5284
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5268
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5252
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5244
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5228
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5212
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5196
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5172
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5164
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5156
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5140
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5132
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5124
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3736
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:680
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3416
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3500
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4560
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:704
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:564
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:940
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2588
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3076
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4336
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1244
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1152
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2200
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5016
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3900
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4544
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4428
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4536
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4664
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2940
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3328
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2476
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4768
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4048
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1452
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5092
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:392
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3524
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3556
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:956
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4632
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4412
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:968
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2024
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3516
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3544
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3676
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:316
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1472
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4500
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:572
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3016
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1608
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:432
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3848
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1432
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3484
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3132
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:412
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:892
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:904
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4024
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5084
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3420
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4712
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1576
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3044
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1536
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4508
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3464
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1000
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1056
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2480
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3296
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3232
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3936
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4936
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3256
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4084
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3424
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3752
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1144
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3148
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3896
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:3744
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  C:\Users\Admin\AppData\Local\Temp\cd2fb1d044d414dcbf32bf67f2563208.exe
  2⤵
  PID:4784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-0-0x0000000002270000-0x0000000002275000-memory.dmp

Filesize
20KB

Download