Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

fe486621f8...0N.exe

windows7-x64

7

fe486621f8...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    13s
  • max time network
    65s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 18:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fe486621f8b989623330a8c63dc803d0N.exe

  • Size

    761KB

  • MD5

    fe486621f8b989623330a8c63dc803d0

  • SHA1

    95c7f205773fabf11aa4ddf7df87043dc4355118

  • SHA256

    e4fabd3e19b49f8ff26803c4b422cd163d2ff123facec184f176895b4ebb5d53

  • SHA512

    01d9a84fdd9c9f20af35c84b46e58c90b7a542d639cc648a7b4cc67805ff48524dd533ba9fc82dad247839fdc87b7bb89c3f9aa00c2fc1fbc44b4f3c035d0446

  • SSDEEP

    12288:OWji9B3foJxwU+fidmVrc/68fkS9x1vthjFgT7b1g4s735XEE4CkUW7uNSmmlK8K:C3foJxwU+SmVw68fDLhxgDhM35/4CkUv

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 17 IoCs
  • Drops file in Windows directory 49 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2112
      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3588
          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:100
            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
              6⤵
                PID:2348
                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                  7⤵
                    PID:7420
                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                    7⤵
                      PID:9796
                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                      7⤵
                        PID:13556
                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                      6⤵
                        PID:5852
                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                          7⤵
                            PID:10328
                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                          6⤵
                            PID:7304
                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                              7⤵
                                PID:13372
                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                              6⤵
                                PID:9504
                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                6⤵
                                  PID:13060
                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                5⤵
                                  PID:4224
                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                    6⤵
                                      PID:6448
                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                        7⤵
                                          PID:11536
                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                        6⤵
                                          PID:8636
                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                          6⤵
                                            PID:11780
                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                          5⤵
                                            PID:5640
                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                              6⤵
                                                PID:9572
                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                6⤵
                                                  PID:13068
                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                5⤵
                                                  PID:7032
                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                    6⤵
                                                      PID:12024
                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                    5⤵
                                                      PID:6776
                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                      5⤵
                                                        PID:12748
                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                      4⤵
                                                      • Checks computer location settings
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3912
                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                        5⤵
                                                          PID:4028
                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                            6⤵
                                                              PID:6696
                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                7⤵
                                                                  PID:11588
                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                6⤵
                                                                  PID:8724
                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                  6⤵
                                                                    PID:12128
                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                  5⤵
                                                                    PID:5832
                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                      6⤵
                                                                        PID:10268
                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                      5⤵
                                                                        PID:7288
                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                          6⤵
                                                                            PID:13400
                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                          5⤵
                                                                            PID:9484
                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                            5⤵
                                                                              PID:13272
                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                            4⤵
                                                                              PID:3796
                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                5⤵
                                                                                  PID:5760
                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                    6⤵
                                                                                      PID:9708
                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                      6⤵
                                                                                        PID:13320
                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                      5⤵
                                                                                        PID:7252
                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                          6⤵
                                                                                            PID:13256
                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                          5⤵
                                                                                            PID:9444
                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                            5⤵
                                                                                              PID:12980
                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                            4⤵
                                                                                              PID:5480
                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                5⤵
                                                                                                  PID:8708
                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                  5⤵
                                                                                                    PID:11916
                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                  4⤵
                                                                                                    PID:6716
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                      5⤵
                                                                                                        PID:11808
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                      4⤵
                                                                                                        PID:8804
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                        4⤵
                                                                                                          PID:12104
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                        3⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4300
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                          4⤵
                                                                                                          • Checks computer location settings
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:3836
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                            5⤵
                                                                                                              PID:4824
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                6⤵
                                                                                                                  PID:6064
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                    7⤵
                                                                                                                      PID:11044
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                    6⤵
                                                                                                                      PID:7996
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                      6⤵
                                                                                                                        PID:10780
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                      5⤵
                                                                                                                        PID:5544
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                          6⤵
                                                                                                                            PID:9064
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                            6⤵
                                                                                                                              PID:12516
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                            5⤵
                                                                                                                              PID:6872
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:12440
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:8944
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:12432
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:2396
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                      5⤵
                                                                                                                                        PID:5768
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:10212
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:7244
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                            5⤵
                                                                                                                                              PID:9316
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:12780
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:5424
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                  5⤵
                                                                                                                                                    PID:8580
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:11688
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:6704
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:11800
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:8716
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:12144
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                          PID:2460
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2028
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:5936
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:10368
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:7456
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:9912
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:13724
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:5468
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:8904
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:12392
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:6760
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:11664
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:8812
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:12136
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2456
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:5484
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:8688
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:12164
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:6740
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:12188
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:8844
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:12156
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:8420
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:11476
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:6432
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:11568
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:8592
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:11652
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                PID:3076
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:3448
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:7000
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                PID:13564
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                PID:9028
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:12508
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                      PID:10340
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:7328
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                          PID:13708
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:9780
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:13536
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:2884
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                    PID:10888
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:8004
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:10816
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:5632
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:9640
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:3520
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:6980
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:12016
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:9044
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:12524
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:6440
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:11628
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                            PID:8360
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                              PID:11412
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:5796
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:9716
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:13216
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:7236
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:9328
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:12936
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:4764
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:6308
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:11544
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:8172
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:11032
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:9880
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:13752
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:6884
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:11644
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:9048
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:12740
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                              PID:1152
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:4388
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:8308
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                            PID:11368
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                            PID:6192
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                PID:10824
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                PID:7972
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                  PID:10956
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:5160
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                      PID:7792
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                        PID:10568
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:6128
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                            PID:10728
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:7736
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:10424
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:3492
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5280
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:8188
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                        PID:11220
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6360
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                            PID:11552
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:8180
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:396
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6940
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:13264
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:9076
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:12604
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:10304
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:7540
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:9996
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3632
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:7708
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:10392
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6424
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:9344
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:8300
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:11324
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:7800
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:10616
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:11172
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:7500
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:13652
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:9952
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:13932
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7960
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10836
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6400
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11492
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8524
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11680
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7280
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13716
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9476
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12968
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10220
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7548
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fe486621f8b989623330a8c63dc803d0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10172

                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\lesbian voyeur femdom .rar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                              708KB

                                                                                                                                                                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                              926df9a52ae7f6d9e5f681bf9a9f7900

                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                              74b7db54ca6afce35754d11382d0a9d5d4a635a0

                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                              a7eb978f371d36434b1db4893e348df1047f52fd9624b24c901b6a595e8ccc6c

                                                                                                                                                                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                              cb59c7cd364e756f8e3cfc00ed3ac7f219bd37828e98aec7a2508864f05dc3201da2adcb6fcfc00b91aa647b27b22148cb9845b480f13352010e571bbf6a7589

                                                                                                                                                                                                                                                                                                                                                                                                                                              Download Submit