75bd69e4009a93ef0352ad26a7a30bc2a0edb49a86b30a11e9610e7600fb3a54

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5091fe1c7f537103ea45ab73884f0c40N.exe
Size

561KB
MD5

5091fe1c7f537103ea45ab73884f0c40
SHA1

fcd3fb1952e346316fac17795442e990f1d1d116
SHA256

75bd69e4009a93ef0352ad26a7a30bc2a0edb49a86b30a11e9610e7600fb3a54
SHA512

6939e7450cce353dfa36ec6110fd917e945dea04e4a86d63faa264439b5d20b302892bf33b2101a16374f2d7121f72f18cb234d96a43c266cabb43f6f14ee2a7
SSDEEP

12288:dXCNi9B/zZOFw5lACbevf1gtRoCymizViMysRw5gMz1MIl6SiSJmpckBeuy:oWdkwTVegtRoCymCi7sG5gMZ6HtOh

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	5091fe1c7f537103ea45ab73884f0c40N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\I:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\X:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\B:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\O:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\Q:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\W:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\Z:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\Y:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\J:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\K:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\N:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\P:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\R:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\T:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\V:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\E:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\G:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\H:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\L:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\M:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\S:	5091fe1c7f537103ea45ab73884f0c40N.exe
File opened (read-only)	\??\U:	5091fe1c7f537103ea45ab73884f0c40N.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\FxsTmp\danish sperm beast [milf] mature (Gina,Tatjana).avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\IME\shared\trambling beastiality uncut nipples gorgeoushorny .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\hardcore girls .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\System32\DriverStore\Temp\italian blowjob voyeur .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\russian animal sleeping granny .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian fetish blowjob licking .mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\FxsTmp\japanese horse full movie .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\IME\shared\african beastiality masturbation upskirt .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\bukkake lesbian girls cock YEâPSè& .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\japanese trambling [bangbus] balls (Liz,Sandy).zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\spanish porn sperm hidden boobs .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\danish beast horse licking 50+ .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\kicking sleeping (Sarah).rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\lingerie licking 40+ .mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\norwegian blowjob hardcore public sm .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files\DVD Maker\Shared\hardcore bukkake girls .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files\Windows Journal\Templates\indian lingerie nude [bangbus] circumcision .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\russian bukkake [bangbus] young .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\trambling several models fishy .mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\swedish xxx masturbation redhair .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\asian lingerie sperm sleeping blondie .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\danish cum nude hidden gorgeoushorny .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\french kicking [bangbus] legs castration .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Google\Temp\nude public glans ìï (Jenna,Sonja).mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Program Files (x86)\Google\Update\Download\canadian lesbian blowjob several models 50+ (Christine).avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\italian cum sleeping (Curtney,Jenna).zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\cum beast catfight .mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\horse animal uncut feet stockings (Karin).rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\swedish beastiality nude big feet wifey .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\PLA\Templates\german trambling porn hot (!) vagina redhair (Anniston).avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\bukkake gang bang girls bedroom .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\french lesbian blowjob sleeping nipples leather .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\hardcore xxx sleeping hole boots .mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\danish gang bang lesbian mistress (Kathrin,Karin).mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\SoftwareDistribution\Download\japanese action beast hot (!) .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\beast handjob public young .mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\spanish xxx [bangbus] cock (Janette,Janette).mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\Downloaded Program Files\italian gang bang sperm lesbian gorgeoushorny .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\action licking legs leather .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\british trambling [milf] 40+ (Sylvia).rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\mssrv.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\spanish lingerie handjob hidden sweet .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\malaysia fucking hardcore voyeur boobs fishy .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\gang bang cumshot catfight .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\temp\bukkake beastiality catfight swallow .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\asian gang bang fetish catfight granny .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\security\templates\french lesbian cum [free] (Christine).rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\fetish [bangbus] blondie .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\american porn masturbation YEâPSè& .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\trambling [bangbus] (Sonja,Sylvia).avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\kicking uncut girly .mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\malaysia horse action hot (!) ash .zip.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\french beastiality sleeping ash wifey .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\tmp\tyrkish handjob hardcore big girly .rar.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\german fetish lesbian wifey (Gina,Anniston).mpeg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\spanish lingerie hot (!) pregnant .avi.exe	5091fe1c7f537103ea45ab73884f0c40N.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\canadian beastiality [free] penetration (Melissa).mpg.exe	5091fe1c7f537103ea45ab73884f0c40N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2316	5091fe1c7f537103ea45ab73884f0c40N.exe
2176	5091fe1c7f537103ea45ab73884f0c40N.exe
2316	5091fe1c7f537103ea45ab73884f0c40N.exe
2540	5091fe1c7f537103ea45ab73884f0c40N.exe
2652	5091fe1c7f537103ea45ab73884f0c40N.exe
2316	5091fe1c7f537103ea45ab73884f0c40N.exe
2176	5091fe1c7f537103ea45ab73884f0c40N.exe
1048	5091fe1c7f537103ea45ab73884f0c40N.exe
1112	5091fe1c7f537103ea45ab73884f0c40N.exe
2752	5091fe1c7f537103ea45ab73884f0c40N.exe
1416	5091fe1c7f537103ea45ab73884f0c40N.exe
2540	5091fe1c7f537103ea45ab73884f0c40N.exe
2652	5091fe1c7f537103ea45ab73884f0c40N.exe
2176	5091fe1c7f537103ea45ab73884f0c40N.exe
2316	5091fe1c7f537103ea45ab73884f0c40N.exe
2176	5091fe1c7f537103ea45ab73884f0c40N.exe
1048	5091fe1c7f537103ea45ab73884f0c40N.exe
2652	5091fe1c7f537103ea45ab73884f0c40N.exe
1712	5091fe1c7f537103ea45ab73884f0c40N.exe
332	5091fe1c7f537103ea45ab73884f0c40N.exe
1784	5091fe1c7f537103ea45ab73884f0c40N.exe
1708	5091fe1c7f537103ea45ab73884f0c40N.exe
2220	5091fe1c7f537103ea45ab73884f0c40N.exe
2540	5091fe1c7f537103ea45ab73884f0c40N.exe
1112	5091fe1c7f537103ea45ab73884f0c40N.exe
2316	5091fe1c7f537103ea45ab73884f0c40N.exe
2940	5091fe1c7f537103ea45ab73884f0c40N.exe
2036	5091fe1c7f537103ea45ab73884f0c40N.exe
2752	5091fe1c7f537103ea45ab73884f0c40N.exe
2104	5091fe1c7f537103ea45ab73884f0c40N.exe
1416	5091fe1c7f537103ea45ab73884f0c40N.exe
2852	5091fe1c7f537103ea45ab73884f0c40N.exe
2176	5091fe1c7f537103ea45ab73884f0c40N.exe
672	5091fe1c7f537103ea45ab73884f0c40N.exe
996	5091fe1c7f537103ea45ab73884f0c40N.exe
848	5091fe1c7f537103ea45ab73884f0c40N.exe
1048	5091fe1c7f537103ea45ab73884f0c40N.exe
2652	5091fe1c7f537103ea45ab73884f0c40N.exe
1112	5091fe1c7f537103ea45ab73884f0c40N.exe
2220	5091fe1c7f537103ea45ab73884f0c40N.exe
1752	5091fe1c7f537103ea45ab73884f0c40N.exe
1752	5091fe1c7f537103ea45ab73884f0c40N.exe
2540	5091fe1c7f537103ea45ab73884f0c40N.exe
2540	5091fe1c7f537103ea45ab73884f0c40N.exe
332	5091fe1c7f537103ea45ab73884f0c40N.exe
332	5091fe1c7f537103ea45ab73884f0c40N.exe
1712	5091fe1c7f537103ea45ab73884f0c40N.exe
1712	5091fe1c7f537103ea45ab73884f0c40N.exe
1528	5091fe1c7f537103ea45ab73884f0c40N.exe
1528	5091fe1c7f537103ea45ab73884f0c40N.exe
1532	5091fe1c7f537103ea45ab73884f0c40N.exe
1532	5091fe1c7f537103ea45ab73884f0c40N.exe
2104	5091fe1c7f537103ea45ab73884f0c40N.exe
2104	5091fe1c7f537103ea45ab73884f0c40N.exe
2200	5091fe1c7f537103ea45ab73884f0c40N.exe
2200	5091fe1c7f537103ea45ab73884f0c40N.exe
1684	5091fe1c7f537103ea45ab73884f0c40N.exe
1684	5091fe1c7f537103ea45ab73884f0c40N.exe
2296	5091fe1c7f537103ea45ab73884f0c40N.exe
2296	5091fe1c7f537103ea45ab73884f0c40N.exe
1364	5091fe1c7f537103ea45ab73884f0c40N.exe
1364	5091fe1c7f537103ea45ab73884f0c40N.exe
1820	5091fe1c7f537103ea45ab73884f0c40N.exe
1820	5091fe1c7f537103ea45ab73884f0c40N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2176	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	30
PID 2316 wrote to memory of 2176	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	30
PID 2316 wrote to memory of 2176	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	30
PID 2316 wrote to memory of 2176	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	30
PID 2176 wrote to memory of 2540	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	31
PID 2176 wrote to memory of 2540	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	31
PID 2176 wrote to memory of 2540	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	31
PID 2176 wrote to memory of 2540	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	31
PID 2316 wrote to memory of 2652	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	32
PID 2316 wrote to memory of 2652	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	32
PID 2316 wrote to memory of 2652	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	32
PID 2316 wrote to memory of 2652	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	32
PID 2652 wrote to memory of 1048	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	34
PID 2652 wrote to memory of 1048	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	34
PID 2652 wrote to memory of 1048	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	34
PID 2652 wrote to memory of 1048	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	34
PID 2540 wrote to memory of 1416	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	35
PID 2540 wrote to memory of 1416	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	35
PID 2540 wrote to memory of 1416	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	35
PID 2540 wrote to memory of 1416	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	35
PID 2316 wrote to memory of 2752	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	33
PID 2316 wrote to memory of 2752	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	33
PID 2316 wrote to memory of 2752	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	33
PID 2316 wrote to memory of 2752	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	33
PID 2176 wrote to memory of 1112	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	36
PID 2176 wrote to memory of 1112	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	36
PID 2176 wrote to memory of 1112	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	36
PID 2176 wrote to memory of 1112	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	36
PID 2652 wrote to memory of 1712	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	38
PID 2652 wrote to memory of 1712	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	38
PID 2652 wrote to memory of 1712	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	38
PID 2652 wrote to memory of 1712	2652	5091fe1c7f537103ea45ab73884f0c40N.exe	38
PID 1048 wrote to memory of 1784	1048	5091fe1c7f537103ea45ab73884f0c40N.exe	37
PID 1048 wrote to memory of 1784	1048	5091fe1c7f537103ea45ab73884f0c40N.exe	37
PID 1048 wrote to memory of 1784	1048	5091fe1c7f537103ea45ab73884f0c40N.exe	37
PID 1048 wrote to memory of 1784	1048	5091fe1c7f537103ea45ab73884f0c40N.exe	37
PID 2540 wrote to memory of 1708	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	39
PID 2540 wrote to memory of 1708	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	39
PID 2540 wrote to memory of 1708	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	39
PID 2540 wrote to memory of 1708	2540	5091fe1c7f537103ea45ab73884f0c40N.exe	39
PID 2176 wrote to memory of 332	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	40
PID 2176 wrote to memory of 332	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	40
PID 2176 wrote to memory of 332	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	40
PID 2176 wrote to memory of 332	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	40
PID 2316 wrote to memory of 2220	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	42
PID 2316 wrote to memory of 2220	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	42
PID 2316 wrote to memory of 2220	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	42
PID 2316 wrote to memory of 2220	2316	5091fe1c7f537103ea45ab73884f0c40N.exe	42
PID 1112 wrote to memory of 2940	1112	5091fe1c7f537103ea45ab73884f0c40N.exe	43
PID 1112 wrote to memory of 2940	1112	5091fe1c7f537103ea45ab73884f0c40N.exe	43
PID 1112 wrote to memory of 2940	1112	5091fe1c7f537103ea45ab73884f0c40N.exe	43
PID 1112 wrote to memory of 2940	1112	5091fe1c7f537103ea45ab73884f0c40N.exe	43
PID 2752 wrote to memory of 2036	2752	5091fe1c7f537103ea45ab73884f0c40N.exe	41
PID 2752 wrote to memory of 2036	2752	5091fe1c7f537103ea45ab73884f0c40N.exe	41
PID 2752 wrote to memory of 2036	2752	5091fe1c7f537103ea45ab73884f0c40N.exe	41
PID 2752 wrote to memory of 2036	2752	5091fe1c7f537103ea45ab73884f0c40N.exe	41
PID 1416 wrote to memory of 2104	1416	5091fe1c7f537103ea45ab73884f0c40N.exe	44
PID 1416 wrote to memory of 2104	1416	5091fe1c7f537103ea45ab73884f0c40N.exe	44
PID 1416 wrote to memory of 2104	1416	5091fe1c7f537103ea45ab73884f0c40N.exe	44
PID 1416 wrote to memory of 2104	1416	5091fe1c7f537103ea45ab73884f0c40N.exe	44
PID 2176 wrote to memory of 2852	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	45
PID 2176 wrote to memory of 2852	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	45
PID 2176 wrote to memory of 2852	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	45
PID 2176 wrote to memory of 2852	2176	5091fe1c7f537103ea45ab73884f0c40N.exe	45

C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
"C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:3796
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15652
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:848
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:13268
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3592
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:14092
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:1216
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:1848
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3908
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1752
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:15044
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:332
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3188
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:13200
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:2112
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10396
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:14076
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:14640
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:12888
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:15036
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:6184
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:10116
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:15476
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        7⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:13192
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:15484
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:13252
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:948
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:908
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8516
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10260
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10168
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:4860
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:10140
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:880
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:12872
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8380
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:9588
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8508
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:14616
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10288
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:7916
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
        5⤵
        
        PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:9372
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6240
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:15468
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10100
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:4852
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:6224
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:10208
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:10184
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:6428
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:8524
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
      "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
      4⤵
      PID:15176
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:14604
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:7840
- - C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
    "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
    3⤵
    PID:13244
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  PID:5464
- C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe
  "C:\Users\Admin\AppData\Local\Temp\5091fe1c7f537103ea45ab73884f0c40N.exe"
  2⤵
  PID:10268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\russian bukkake [bangbus] young .mpg.exe

Filesize
1004KB

MD5
d44034861ca73e344e4abb55aa751230

SHA1
584a120066a5510e2344ae05f5bc74f2103fc16e

SHA256
a5141bf4cebd5e3e568500ef752e710d5b30b01b540747b89f3800a066b4c8b0

SHA512
b2c503f9f46aede10adb3448e40362686df7c0d62b97a32fb6022da6d8f5d02e5b8aca31843d953241487e1931c5ee73a02e1507df786ff03bffd3f9203e7f39

Download Submit
memory/332-192-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/332-152-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/332-94-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/672-140-0x00000000047C0000-0x00000000047EB000-memory.dmp

Filesize
172KB

Download
memory/672-171-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/848-118-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/912-153-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/996-172-0x0000000000B20000-0x0000000000B4B000-memory.dmp

Filesize
172KB

Download
memory/996-142-0x0000000000AC0000-0x0000000000AEB000-memory.dmp

Filesize
172KB

Download
memory/1036-167-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/1036-124-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1048-188-0x00000000047C0000-0x00000000047EB000-memory.dmp

Filesize
172KB

Download
memory/1048-173-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/1048-79-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1048-143-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/1048-185-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1112-96-0x0000000000740000-0x000000000076B000-memory.dmp

Filesize
172KB

Download
memory/1112-174-0x0000000004A90000-0x0000000004ABB000-memory.dmp

Filesize
172KB

Download
memory/1112-186-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1112-81-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1112-147-0x0000000004620000-0x000000000464B000-memory.dmp

Filesize
172KB

Download
memory/1216-128-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1216-170-0x00000000045D0000-0x00000000045FB000-memory.dmp

Filesize
172KB

Download
memory/1364-119-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1364-166-0x0000000004910000-0x000000000493B000-memory.dmp

Filesize
172KB

Download
memory/1416-82-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1416-183-0x0000000004590000-0x00000000045BB000-memory.dmp

Filesize
172KB

Download
memory/1416-187-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1416-154-0x0000000004590000-0x00000000045BB000-memory.dmp

Filesize
172KB

Download
memory/1528-160-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/1528-122-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1532-125-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1532-161-0x0000000004820000-0x000000000484B000-memory.dmp

Filesize
172KB

Download
memory/1640-138-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1684-129-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1684-163-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/1708-190-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1708-158-0x0000000001F40000-0x0000000001F6B000-memory.dmp

Filesize
172KB

Download
memory/1708-92-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1712-175-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/1712-93-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1712-191-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-117-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1752-159-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/1784-95-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1820-165-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/1820-120-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1848-157-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2036-99-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2104-181-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/2104-102-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2112-139-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2176-169-0x0000000004A90000-0x0000000004ABB000-memory.dmp

Filesize
172KB

Download
memory/2176-177-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2176-44-0x0000000001EA0000-0x0000000001ECB000-memory.dmp

Filesize
172KB

Download
memory/2176-178-0x0000000001EA0000-0x0000000001ECB000-memory.dmp

Filesize
172KB

Download
memory/2176-112-0x0000000004A90000-0x0000000004ABB000-memory.dmp

Filesize
172KB

Download
memory/2176-137-0x0000000004A90000-0x0000000004ABB000-memory.dmp

Filesize
172KB

Download
memory/2200-127-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2200-164-0x0000000004910000-0x000000000493B000-memory.dmp

Filesize
172KB

Download
memory/2220-149-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/2220-97-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2296-162-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/2296-130-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2316-46-0x0000000004A80000-0x0000000004AAB000-memory.dmp

Filesize
172KB

Download
memory/2316-176-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2316-74-0x0000000004A80000-0x0000000004AAB000-memory.dmp

Filesize
172KB

Download
memory/2316-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2316-9-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/2316-182-0x0000000004A80000-0x0000000004AAB000-memory.dmp

Filesize
172KB

Download
memory/2376-123-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2376-168-0x0000000004950000-0x000000000497B000-memory.dmp

Filesize
172KB

Download
memory/2540-76-0x00000000044B0000-0x00000000044DB000-memory.dmp

Filesize
172KB

Download
memory/2540-151-0x0000000004930000-0x000000000495B000-memory.dmp

Filesize
172KB

Download
memory/2540-91-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/2540-45-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2552-145-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2580-148-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-146-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2652-114-0x0000000004A80000-0x0000000004AAB000-memory.dmp

Filesize
172KB

Download
memory/2652-189-0x0000000004A80000-0x0000000004AAB000-memory.dmp

Filesize
172KB

Download
memory/2652-179-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2652-180-0x0000000004800000-0x000000000482B000-memory.dmp

Filesize
172KB

Download
memory/2652-75-0x0000000004800000-0x000000000482B000-memory.dmp

Filesize
172KB

Download
memory/2652-144-0x0000000004A80000-0x0000000004AAB000-memory.dmp

Filesize
172KB

Download
memory/2652-48-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2708-141-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2752-80-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2752-184-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2852-113-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2868-156-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2940-98-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2940-126-0x0000000004590000-0x00000000045BB000-memory.dmp

Filesize
172KB

Download
memory/2940-155-0x00000000045E0000-0x000000000460B000-memory.dmp

Filesize
172KB

Download
memory/2964-136-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-150-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download