2c3632b9b270c71263b973ee449818526b22d10b5de896568b466d0bf13f49cd

Analysis

max time kernel
9s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Size

1.4MB
MD5

6464a5eaa0c8bc757ed0a2d2f1f8d900
SHA1

0714ac967da0c47a7a925b620b8bdc21af85284e
SHA256

2c3632b9b270c71263b973ee449818526b22d10b5de896568b466d0bf13f49cd
SHA512

11d60d58241db03420d977b77624631e5f7c16adda01781271393b780760abb31626f42ed3e6d4238dd5108a9a27c462f0e24629fd1a575fe52e08611ffa37b8
SSDEEP

24576:oWQrtgYq4XX7ekMoN+Z5ymRBOIqlNoF3FH83exHnF7OulcrPYuHKe+Z9Jtw:VSzXik3N+Z5ymuN08GHoulbW+ZK

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\S:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\W:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\Y:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\H:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\M:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\P:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\T:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\A:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\B:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\J:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\O:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\U:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\G:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\I:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\K:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\R:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\V:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\X:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\Z:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\E:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\L:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File opened (read-only)	\??\N:	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\malaysia horse cum [bangbus] 40+ .mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\gang bang fucking several models legs balls .mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\System32\DriverStore\Temp\tyrkish action [milf] (Curtney).avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SysWOW64\FxsTmp\swedish bukkake [free] fishy (Ashley,Christine).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SysWOW64\IME\SHARED\african handjob horse hidden circumcision (Gina,Gina).rar.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\asian animal fetish hidden .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\brasilian porn several models .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\xxx hidden black hairunshaved .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\american handjob blowjob public vagina (Kathrin).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\asian hardcore [bangbus] girly .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Google\Temp\japanese porn [free] Ôï .rar.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\fucking animal hidden .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Common Files\microsoft shared\tyrkish fetish lesbian .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\canadian horse several models titts sm .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\canadian gay lesbian .mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Microsoft\Temp\horse action uncut .rar.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\dotnet\shared\bukkake fetish catfight .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\handjob hot (!) .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\blowjob licking balls .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\lesbian full movie upskirt .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\norwegian beastiality lesbian legs granny (Sandy).zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Google\Update\Download\bukkake beastiality masturbation titts swallow (Britney).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\black kicking [bangbus] Ôï .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\swedish blowjob catfight (Karin,Jenna).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\hardcore lingerie licking cock gorgeoushorny .rar.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\danish lesbian gang bang catfight cock mature (Sandy).zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SoftwareDistribution\Download\animal blowjob [free] boobs (Anniston).mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\porn beastiality full movie hole .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\black kicking full movie ash stockings .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\assembly\tmp\swedish lesbian big high heels .mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\italian blowjob cum [free] .rar.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\horse masturbation ash (Jenna,Janette).rar.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\assembly\temp\beast fetish public cock redhair .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\danish beast licking bedroom .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SoftwareDistribution\Download\SharedFileCache\black nude full movie bondage .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\bukkake masturbation (Liz).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\mssrv.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\canadian gay sperm [milf] leather .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black horse lingerie girls nipples (Jenna).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\PLA\Templates\handjob hot (!) boobs leather (Ashley,Sylvia).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\security\templates\norwegian lesbian nude voyeur leather (Melissa).mpg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\chinese action fetish hidden nipples ejaculation (Gina,Melissa).mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\porn beastiality masturbation shower (Karin,Tatjana).avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\nude lesbian [milf] hole .mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\CbsTemp\russian action lesbian several models sm .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore cumshot sleeping (Sonja).mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\british trambling gang bang big feet .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\Downloaded Program Files\american xxx nude uncut .zip.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\brasilian trambling blowjob full movie shoes (Jenna,Jenna).mpeg.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\InputMethod\SHARED\canadian cumshot trambling full movie .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\german animal uncut shower .avi.exe	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2440	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2440	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1416	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1416	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4420	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
4420	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2796	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
2796	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2408	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	87
PID 4612 wrote to memory of 2408	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	87
PID 4612 wrote to memory of 2408	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	87
PID 2408 wrote to memory of 1028	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	90
PID 2408 wrote to memory of 1028	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	90
PID 2408 wrote to memory of 1028	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	90
PID 4612 wrote to memory of 1712	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	91
PID 4612 wrote to memory of 1712	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	91
PID 4612 wrote to memory of 1712	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	91
PID 4612 wrote to memory of 2440	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	94
PID 4612 wrote to memory of 2440	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	94
PID 4612 wrote to memory of 2440	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	94
PID 2408 wrote to memory of 1416	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	95
PID 2408 wrote to memory of 1416	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	95
PID 2408 wrote to memory of 1416	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	95
PID 1712 wrote to memory of 4420	1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	96
PID 1712 wrote to memory of 4420	1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	96
PID 1712 wrote to memory of 4420	1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	96
PID 1028 wrote to memory of 2796	1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	97
PID 1028 wrote to memory of 2796	1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	97
PID 1028 wrote to memory of 2796	1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	97
PID 2408 wrote to memory of 116	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	99
PID 2408 wrote to memory of 116	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	99
PID 2408 wrote to memory of 116	2408	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	99
PID 4612 wrote to memory of 348	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	100
PID 4612 wrote to memory of 348	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	100
PID 4612 wrote to memory of 348	4612	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	100
PID 1712 wrote to memory of 544	1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	101
PID 1712 wrote to memory of 544	1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	101
PID 1712 wrote to memory of 544	1712	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	101
PID 2440 wrote to memory of 4128	2440	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	102
PID 2440 wrote to memory of 4128	2440	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	102
PID 2440 wrote to memory of 4128	2440	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	102
PID 1028 wrote to memory of 1248	1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	103
PID 1028 wrote to memory of 1248	1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	103
PID 1028 wrote to memory of 1248	1028	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	103
PID 1416 wrote to memory of 3132	1416	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	104
PID 1416 wrote to memory of 3132	1416	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	104
PID 1416 wrote to memory of 3132	1416	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	104
PID 4420 wrote to memory of 640	4420	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	105
PID 4420 wrote to memory of 640	4420	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	105
PID 4420 wrote to memory of 640	4420	6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe	105

C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
"C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        8⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        8⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:13696
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12032
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14076
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12672
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:12224
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:4632
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13288
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13196
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:4480
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11808
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:16092
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11956
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:13116
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:16084
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:10652
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:15600
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        7⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12796
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:16048
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:1544
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:544
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:11860
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:13032
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:4492
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11948
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:12832
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:13224
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:9004
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:12040
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        6⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:9856
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:14944
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:12804
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12436
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:13840
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:15716
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:14288
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:9212
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:11500
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:348
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:11940
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:14936
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:12840
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:14132
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:8784
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:11652
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:16340
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:3244
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
        5⤵
        
        PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:15644
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:14296
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:11396
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:16072
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:5248
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
      "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
      4⤵
      PID:1796
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:9408
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:11876
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:6392
- - C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
    "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
    3⤵
    PID:13788
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:8512
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:11420
- C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe
  "C:\Users\Admin\AppData\Local\Temp\6464a5eaa0c8bc757ed0a2d2f1f8d900N.exe"
  2⤵
  PID:16064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\canadian horse several models titts sm .avi.exe

Filesize
1.8MB

MD5
e696f48061590f891c46a75bc62c239d

SHA1
f6ba4b10a9f2b57e83d59cee7603519f68a89208

SHA256
73c11153b4e4298cb8e1a8f22fbf871ea486d4c68b5aed8dde915a2c92034a39

SHA512
eec696859ff5898cd11d649063ed7c4814eb3bbafdc6d8e066a8f95845347169f0910b28421d53ace8c8be91f3d242876b5ca1be67aca75fabe565e92ae768d6

Download Submit
memory/544-230-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/640-234-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1028-168-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1044-247-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1248-232-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1416-209-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1712-173-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1732-249-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2796-211-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3132-233-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3244-245-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3456-235-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3676-246-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3832-248-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4128-231-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4420-210-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4612-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5132-300-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5176-250-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5192-251-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5248-252-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5324-253-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5492-254-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5508-255-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5516-256-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5524-257-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5604-258-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5612-259-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5624-260-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5748-261-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5764-263-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5820-262-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5892-264-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5912-266-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5968-265-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6168-267-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6244-268-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6252-269-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6292-283-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6332-270-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6376-271-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6460-272-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6664-273-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6788-274-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6832-275-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6844-276-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6852-277-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6860-278-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6868-279-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7048-280-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7056-281-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7108-282-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7208-284-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7364-285-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7372-289-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7380-290-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7388-291-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7436-286-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7496-295-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7504-287-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7512-288-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7592-292-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7616-293-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7624-294-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7704-296-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7784-297-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7884-298-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7892-299-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8204-301-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8280-302-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8288-303-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8420-304-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8468-305-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8512-306-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8772-307-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8784-308-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8904-310-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8948-309-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8964-311-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8980-312-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8988-313-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8996-314-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9032-315-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9128-316-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9136-317-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9156-318-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9164-319-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9172-320-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9180-321-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9188-322-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9196-323-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9212-324-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9376-325-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9396-326-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9408-327-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9516-328-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download