1ad4ad80989766a3ceb74049c2ad9a923dbee9f09f2b87a10c6cc087e045ef23

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69096228777184aa9efce40475cf8f00N.exe
Size

731KB
MD5

69096228777184aa9efce40475cf8f00
SHA1

044af74c464e49447bc47630eb0b5e45416ff5ad
SHA256

1ad4ad80989766a3ceb74049c2ad9a923dbee9f09f2b87a10c6cc087e045ef23
SHA512

517cf5871b4913aee7032b7eafb1b83d5ca44109fbd23c7964699e7c04d992d73cf3c6be8c230fe4f9d0bcdeb6cfe16e0ab584fa95eac77a34964c2991ca7594
SSDEEP

12288:NPKL+0EoCfb+s2XilZhUdUfzKLE+dTbyvZKa6WvWFUQAuXznu8sMzN2TVHU7ISNO:NSLlEoCfeefULLHVyRKGWeLuTaI2T1Uy

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/624-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0003000000017801-5.dat	upx
behavioral1/memory/2820-11-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/624-31-0x0000000004C10000-0x0000000004C2E000-memory.dmp	upx
behavioral1/memory/2824-32-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2820-33-0x0000000004A00000-0x0000000004A1E000-memory.dmp	upx
behavioral1/memory/2824-67-0x0000000004580000-0x000000000459E000-memory.dmp	upx
behavioral1/memory/2404-68-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2112-74-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2820-73-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/624-70-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2884-71-0x00000000047B0000-0x00000000047CE000-memory.dmp	upx
behavioral1/memory/2120-82-0x00000000047C0000-0x00000000047DE000-memory.dmp	upx
behavioral1/memory/2344-84-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2824-89-0x0000000004580000-0x000000000459E000-memory.dmp	upx
behavioral1/memory/2404-91-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2468-93-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2208-99-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2120-101-0x00000000047C0000-0x00000000047DE000-memory.dmp	upx
behavioral1/memory/2256-104-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1656-107-0x00000000044A0000-0x00000000044BE000-memory.dmp	upx
behavioral1/memory/2468-108-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1900-109-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1544-111-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2256-113-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2724-115-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2148-119-0x00000000047D0000-0x00000000047EE000-memory.dmp	upx
behavioral1/memory/1900-118-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/776-121-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2468-122-0x0000000004900000-0x000000000491E000-memory.dmp	upx
behavioral1/memory/2724-123-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2480-124-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2836-125-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2456-126-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2468-127-0x0000000004900000-0x000000000491E000-memory.dmp	upx
behavioral1/memory/692-128-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2780-129-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/884-135-0x0000000001DE0000-0x0000000001DFE000-memory.dmp	upx
behavioral1/memory/2480-134-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2836-147-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2828-148-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/328-150-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2644-151-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/940-152-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/660-155-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2272-156-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2208-162-0x0000000004910000-0x000000000492E000-memory.dmp	upx
behavioral1/memory/1016-163-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1900-164-0x00000000047C0000-0x00000000047DE000-memory.dmp	upx
behavioral1/memory/3156-166-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3288-170-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3312-171-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3428-177-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3464-186-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3288-185-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3312-189-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3328-190-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3572-193-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/884-192-0x0000000004930000-0x000000000494E000-memory.dmp	upx
behavioral1/memory/3596-194-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3684-205-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3820-209-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3936-210-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3924-212-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	69096228777184aa9efce40475cf8f00N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\O:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\P:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\T:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\B:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\H:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\W:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\M:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\U:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\R:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\V:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\X:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\Y:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\E:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\I:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\J:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\L:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\N:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\Q:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\S:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\Z:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\A:	69096228777184aa9efce40475cf8f00N.exe
File opened (read-only)	\??\G:	69096228777184aa9efce40475cf8f00N.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\tyrkish nude blowjob several models latex .rar.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files\Windows Journal\Templates\trambling public hole shoes .zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\russian action gay hot (!) glans .avi.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\danish nude trambling [bangbus] (Melissa).rar.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black porn trambling licking cock .mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\russian animal fucking full movie feet black hairunshaved (Sarah).mpg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Google\Update\Download\danish porn beast [milf] .rar.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\fucking girls (Tatjana).mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\black horse bukkake hidden fishy (Sonja,Janette).mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\blowjob masturbation cock .avi.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\tyrkish gang bang lesbian [free] hole boots .avi.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Google\Temp\hardcore big (Sylvia).zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\tyrkish cumshot lesbian several models .mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\danish horse hardcore catfight hole hotel (Karin).avi.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\indian horse bukkake hidden hole leather .mpeg.exe	69096228777184aa9efce40475cf8f00N.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\fucking licking hole hotel (Tatjana).zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\indian beastiality blowjob uncut Ôë .zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\russian horse lingerie catfight hole upskirt .rar.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\tyrkish handjob bukkake public feet .rar.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\trambling big (Curtney).mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\tyrkish animal blowjob sleeping glans (Kathrin,Jade).zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\mssrv.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\japanese gang bang horse voyeur .zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm voyeur glans balls .mpg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\hardcore uncut circumcision .avi.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\japanese nude fucking catfight cock (Christine,Janette).mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\italian action lingerie hot (!) feet .zip.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\Downloaded Program Files\swedish beastiality xxx [bangbus] .mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\american cumshot fucking several models .mpg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\temp\brasilian handjob trambling masturbation glans .mpeg.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\brasilian cumshot fucking masturbation .rar.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\indian cumshot sperm masturbation beautyfull .avi.exe	69096228777184aa9efce40475cf8f00N.exe
File created	C:\Windows\assembly\tmp\lesbian big feet 40+ .mpeg.exe	69096228777184aa9efce40475cf8f00N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
624	69096228777184aa9efce40475cf8f00N.exe
2820	69096228777184aa9efce40475cf8f00N.exe
624	69096228777184aa9efce40475cf8f00N.exe
2824	69096228777184aa9efce40475cf8f00N.exe
2884	69096228777184aa9efce40475cf8f00N.exe
624	69096228777184aa9efce40475cf8f00N.exe
2820	69096228777184aa9efce40475cf8f00N.exe
2404	69096228777184aa9efce40475cf8f00N.exe
2120	69096228777184aa9efce40475cf8f00N.exe
2824	69096228777184aa9efce40475cf8f00N.exe
624	69096228777184aa9efce40475cf8f00N.exe
2112	69096228777184aa9efce40475cf8f00N.exe
2552	69096228777184aa9efce40475cf8f00N.exe
2884	69096228777184aa9efce40475cf8f00N.exe
2820	69096228777184aa9efce40475cf8f00N.exe
1244	69096228777184aa9efce40475cf8f00N.exe
2344	69096228777184aa9efce40475cf8f00N.exe
1656	69096228777184aa9efce40475cf8f00N.exe
2120	69096228777184aa9efce40475cf8f00N.exe
2820	69096228777184aa9efce40475cf8f00N.exe
2824	69096228777184aa9efce40475cf8f00N.exe
2404	69096228777184aa9efce40475cf8f00N.exe
332	69096228777184aa9efce40475cf8f00N.exe
624	69096228777184aa9efce40475cf8f00N.exe
2420	69096228777184aa9efce40475cf8f00N.exe
2884	69096228777184aa9efce40475cf8f00N.exe
2148	69096228777184aa9efce40475cf8f00N.exe
2112	69096228777184aa9efce40475cf8f00N.exe
848	69096228777184aa9efce40475cf8f00N.exe
2468	69096228777184aa9efce40475cf8f00N.exe
2552	69096228777184aa9efce40475cf8f00N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2820	624	69096228777184aa9efce40475cf8f00N.exe	30
PID 624 wrote to memory of 2820	624	69096228777184aa9efce40475cf8f00N.exe	30
PID 624 wrote to memory of 2820	624	69096228777184aa9efce40475cf8f00N.exe	30
PID 624 wrote to memory of 2820	624	69096228777184aa9efce40475cf8f00N.exe	30
PID 624 wrote to memory of 2824	624	69096228777184aa9efce40475cf8f00N.exe	31
PID 624 wrote to memory of 2824	624	69096228777184aa9efce40475cf8f00N.exe	31
PID 624 wrote to memory of 2824	624	69096228777184aa9efce40475cf8f00N.exe	31
PID 624 wrote to memory of 2824	624	69096228777184aa9efce40475cf8f00N.exe	31
PID 2820 wrote to memory of 2884	2820	69096228777184aa9efce40475cf8f00N.exe	32
PID 2820 wrote to memory of 2884	2820	69096228777184aa9efce40475cf8f00N.exe	32
PID 2820 wrote to memory of 2884	2820	69096228777184aa9efce40475cf8f00N.exe	32
PID 2820 wrote to memory of 2884	2820	69096228777184aa9efce40475cf8f00N.exe	32
PID 2824 wrote to memory of 2404	2824	69096228777184aa9efce40475cf8f00N.exe	33
PID 2824 wrote to memory of 2404	2824	69096228777184aa9efce40475cf8f00N.exe	33
PID 2824 wrote to memory of 2404	2824	69096228777184aa9efce40475cf8f00N.exe	33
PID 2824 wrote to memory of 2404	2824	69096228777184aa9efce40475cf8f00N.exe	33
PID 624 wrote to memory of 2120	624	69096228777184aa9efce40475cf8f00N.exe	34
PID 624 wrote to memory of 2120	624	69096228777184aa9efce40475cf8f00N.exe	34
PID 624 wrote to memory of 2120	624	69096228777184aa9efce40475cf8f00N.exe	34
PID 624 wrote to memory of 2120	624	69096228777184aa9efce40475cf8f00N.exe	34
PID 2884 wrote to memory of 2112	2884	69096228777184aa9efce40475cf8f00N.exe	35
PID 2884 wrote to memory of 2112	2884	69096228777184aa9efce40475cf8f00N.exe	35
PID 2884 wrote to memory of 2112	2884	69096228777184aa9efce40475cf8f00N.exe	35
PID 2884 wrote to memory of 2112	2884	69096228777184aa9efce40475cf8f00N.exe	35
PID 2820 wrote to memory of 2552	2820	69096228777184aa9efce40475cf8f00N.exe	36
PID 2820 wrote to memory of 2552	2820	69096228777184aa9efce40475cf8f00N.exe	36
PID 2820 wrote to memory of 2552	2820	69096228777184aa9efce40475cf8f00N.exe	36
PID 2820 wrote to memory of 2552	2820	69096228777184aa9efce40475cf8f00N.exe	36
PID 2824 wrote to memory of 1244	2824	69096228777184aa9efce40475cf8f00N.exe	37
PID 2824 wrote to memory of 1244	2824	69096228777184aa9efce40475cf8f00N.exe	37
PID 2824 wrote to memory of 1244	2824	69096228777184aa9efce40475cf8f00N.exe	37
PID 2824 wrote to memory of 1244	2824	69096228777184aa9efce40475cf8f00N.exe	37
PID 2404 wrote to memory of 2344	2404	69096228777184aa9efce40475cf8f00N.exe	38
PID 2404 wrote to memory of 2344	2404	69096228777184aa9efce40475cf8f00N.exe	38
PID 2404 wrote to memory of 2344	2404	69096228777184aa9efce40475cf8f00N.exe	38
PID 2404 wrote to memory of 2344	2404	69096228777184aa9efce40475cf8f00N.exe	38
PID 624 wrote to memory of 332	624	69096228777184aa9efce40475cf8f00N.exe	39
PID 624 wrote to memory of 332	624	69096228777184aa9efce40475cf8f00N.exe	39
PID 624 wrote to memory of 332	624	69096228777184aa9efce40475cf8f00N.exe	39
PID 624 wrote to memory of 332	624	69096228777184aa9efce40475cf8f00N.exe	39
PID 2120 wrote to memory of 1656	2120	69096228777184aa9efce40475cf8f00N.exe	40
PID 2120 wrote to memory of 1656	2120	69096228777184aa9efce40475cf8f00N.exe	40
PID 2120 wrote to memory of 1656	2120	69096228777184aa9efce40475cf8f00N.exe	40
PID 2120 wrote to memory of 1656	2120	69096228777184aa9efce40475cf8f00N.exe	40
PID 2820 wrote to memory of 2148	2820	69096228777184aa9efce40475cf8f00N.exe	42
PID 2820 wrote to memory of 2148	2820	69096228777184aa9efce40475cf8f00N.exe	42
PID 2820 wrote to memory of 2148	2820	69096228777184aa9efce40475cf8f00N.exe	42
PID 2820 wrote to memory of 2148	2820	69096228777184aa9efce40475cf8f00N.exe	42
PID 2884 wrote to memory of 2420	2884	69096228777184aa9efce40475cf8f00N.exe	41
PID 2884 wrote to memory of 2420	2884	69096228777184aa9efce40475cf8f00N.exe	41
PID 2884 wrote to memory of 2420	2884	69096228777184aa9efce40475cf8f00N.exe	41
PID 2884 wrote to memory of 2420	2884	69096228777184aa9efce40475cf8f00N.exe	41
PID 2112 wrote to memory of 848	2112	69096228777184aa9efce40475cf8f00N.exe	43
PID 2112 wrote to memory of 848	2112	69096228777184aa9efce40475cf8f00N.exe	43
PID 2112 wrote to memory of 848	2112	69096228777184aa9efce40475cf8f00N.exe	43
PID 2112 wrote to memory of 848	2112	69096228777184aa9efce40475cf8f00N.exe	43
PID 2552 wrote to memory of 2468	2552	69096228777184aa9efce40475cf8f00N.exe	44
PID 2552 wrote to memory of 2468	2552	69096228777184aa9efce40475cf8f00N.exe	44
PID 2552 wrote to memory of 2468	2552	69096228777184aa9efce40475cf8f00N.exe	44
PID 2552 wrote to memory of 2468	2552	69096228777184aa9efce40475cf8f00N.exe	44
PID 1244 wrote to memory of 1716	1244	69096228777184aa9efce40475cf8f00N.exe	45
PID 1244 wrote to memory of 1716	1244	69096228777184aa9efce40475cf8f00N.exe	45
PID 1244 wrote to memory of 1716	1244	69096228777184aa9efce40475cf8f00N.exe	45
PID 1244 wrote to memory of 1716	1244	69096228777184aa9efce40475cf8f00N.exe	45

C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
"C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2268
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10780
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:692
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4044
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10368
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10756
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10852
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2272
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2000
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:328
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:3096
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:7784
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9732
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10844
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:7276
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:11812
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11412
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2664
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10384
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:320
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:7316
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:8176
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10820
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9060
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9868
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9724
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:8244
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:8220
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11112
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10360
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:2292
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10788
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9652
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9812
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10892
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:7024
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:10352
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:332
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:596
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        6⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9796
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10376
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:9764
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10812
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:9916
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:7456
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
        5⤵
        
        PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10908
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10836
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:7776
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:8160
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10876
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:3320
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:10748
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  PID:3328
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
      "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
      4⤵
      PID:10900
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:10692
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  PID:4900
- - C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
    "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
    3⤵
    PID:10980
- C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe
  "C:\Users\Admin\AppData\Local\Temp\69096228777184aa9efce40475cf8f00N.exe"
  2⤵
  PID:7552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\blowjob masturbation cock .avi.exe

Filesize
2.0MB

MD5
cf6386e578e9243f7f57c04a9ec24a26

SHA1
a1de04b4cc8e715ee520f0a73dba17d629a4b2d3

SHA256
87bbca15847dfee8265aeb068d8601b438e37b0665870bcf73140d124164bcdc

SHA512
a59b9b60a411133545cb9c4d1af98c459142491d85798b882ec16dffa4d12f587d6c130c574e898cefa91979ab838522cb547d0dda767288ba3a8c4e73fdf9a4

Download Submit
memory/328-150-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/332-105-0x0000000002010000-0x000000000202E000-memory.dmp

Filesize
120KB

Download
memory/332-114-0x0000000002010000-0x000000000202E000-memory.dmp

Filesize
120KB

Download
memory/624-72-0x0000000004460000-0x000000000447E000-memory.dmp

Filesize
120KB

Download
memory/624-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-102-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/624-92-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/624-80-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/624-69-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/624-100-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/624-10-0x0000000004460000-0x000000000447E000-memory.dmp

Filesize
120KB

Download
memory/624-81-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/624-70-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/624-31-0x0000000004C10000-0x0000000004C2E000-memory.dmp

Filesize
120KB

Download
memory/660-155-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/692-128-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/776-121-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/848-117-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/848-158-0x0000000004A50000-0x0000000004A6E000-memory.dmp

Filesize
120KB

Download
memory/884-192-0x0000000004930000-0x000000000494E000-memory.dmp

Filesize
120KB

Download
memory/884-135-0x0000000001DE0000-0x0000000001DFE000-memory.dmp

Filesize
120KB

Download
memory/940-152-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1016-163-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1244-133-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/1544-165-0x00000000045D0000-0x00000000045EE000-memory.dmp

Filesize
120KB

Download
memory/1544-111-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1656-107-0x00000000044A0000-0x00000000044BE000-memory.dmp

Filesize
120KB

Download
memory/1820-184-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/1900-118-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1900-164-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/1900-109-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2112-74-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2112-90-0x00000000044A0000-0x00000000044BE000-memory.dmp

Filesize
120KB

Download
memory/2112-214-0x0000000004A60000-0x0000000004A7E000-memory.dmp

Filesize
120KB

Download
memory/2120-101-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2120-82-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2148-119-0x00000000047D0000-0x00000000047EE000-memory.dmp

Filesize
120KB

Download
memory/2164-218-0x0000000004920000-0x000000000493E000-memory.dmp

Filesize
120KB

Download
memory/2208-162-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/2208-99-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2240-130-0x00000000047D0000-0x00000000047EE000-memory.dmp

Filesize
120KB

Download
memory/2240-149-0x00000000047D0000-0x00000000047EE000-memory.dmp

Filesize
120KB

Download
memory/2256-113-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2256-104-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2272-156-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2344-84-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2404-112-0x00000000044F0000-0x000000000450E000-memory.dmp

Filesize
120KB

Download
memory/2404-68-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2404-91-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2456-126-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2468-122-0x0000000004900000-0x000000000491E000-memory.dmp

Filesize
120KB

Download
memory/2468-127-0x0000000004900000-0x000000000491E000-memory.dmp

Filesize
120KB

Download
memory/2468-93-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2468-108-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2480-124-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2480-134-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2552-106-0x00000000045C0000-0x00000000045DE000-memory.dmp

Filesize
120KB

Download
memory/2644-151-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2724-123-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2724-115-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2724-222-0x0000000001F30000-0x0000000001F4E000-memory.dmp

Filesize
120KB

Download
memory/2780-129-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2820-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2820-83-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/2820-11-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2820-33-0x0000000004A00000-0x0000000004A1E000-memory.dmp

Filesize
120KB

Download
memory/2824-89-0x0000000004580000-0x000000000459E000-memory.dmp

Filesize
120KB

Download
memory/2824-32-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2824-67-0x0000000004580000-0x000000000459E000-memory.dmp

Filesize
120KB

Download
memory/2828-148-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2836-147-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2836-221-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/2836-125-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2836-201-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/2884-71-0x00000000047B0000-0x00000000047CE000-memory.dmp

Filesize
120KB

Download
memory/2884-110-0x0000000004920000-0x000000000493E000-memory.dmp

Filesize
120KB

Download
memory/2884-120-0x0000000004920000-0x000000000493E000-memory.dmp

Filesize
120KB

Download
memory/3156-166-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3288-170-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3288-185-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3312-189-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3312-171-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3324-224-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3328-190-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3428-177-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3464-186-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3572-193-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3596-194-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3684-205-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3820-209-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3924-212-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3936-210-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3984-213-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4036-220-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4060-225-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4068-223-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download