Overview

overview

7

Static

static

3

06edd2ca69...0N.exe

windows7-x64

7

06edd2ca69...0N.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    27s
  • max time network
    25s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 20:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06edd2ca69da2d38c37a2582141f51f0N.exe

  • Size

    1.9MB

  • MD5

    06edd2ca69da2d38c37a2582141f51f0

  • SHA1

    352387d1d597886f2dbd1216d80ffa855edf9fbe

  • SHA256

    89b514620806c60990e755fdedcfb4343a740eabe940ee2519fcd6f2dd5492ed

  • SHA512

    8203d31450f936278a6df103ac2bbeaed28bc07bd048956b48dc97ea54db86c239817775264a800ad70cb8b20c5d01496f291662c573774582fb34b3d5e90e14

  • SSDEEP

    49152:C/QqNrHozb6mjYCXlOEiYf5WfXGzhggb6Cna:nOIzb1YGpiYf5y0yo69

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2632
    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2276
          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1624
            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3048
              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                7⤵
                  PID:1552
                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                    8⤵
                      PID:3620
                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                        9⤵
                          PID:5840
                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                            10⤵
                              PID:4088
                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                            9⤵
                              PID:8992
                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                              9⤵
                                PID:16276
                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                              8⤵
                                PID:4800
                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                  9⤵
                                    PID:10056
                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                    9⤵
                                      PID:19376
                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                    8⤵
                                      PID:7340
                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                      8⤵
                                        PID:13884
                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                      7⤵
                                        PID:3628
                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                          8⤵
                                            PID:5864
                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                              9⤵
                                                PID:2324
                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                              8⤵
                                                PID:9308
                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                8⤵
                                                  PID:15100
                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                7⤵
                                                  PID:4816
                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                    8⤵
                                                      PID:9400
                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                      8⤵
                                                        PID:15148
                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                      7⤵
                                                        PID:7332
                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                        7⤵
                                                          PID:13732
                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                        6⤵
                                                          PID:1656
                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                            7⤵
                                                              PID:3556
                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                8⤵
                                                                  PID:5636
                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                    9⤵
                                                                      PID:12788
                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                    8⤵
                                                                      PID:8752
                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                      8⤵
                                                                        PID:13596
                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                      7⤵
                                                                        PID:4596
                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                          8⤵
                                                                            PID:9316
                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                            8⤵
                                                                              PID:15336
                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                            7⤵
                                                                              PID:7096
                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                              7⤵
                                                                                PID:13636
                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                              6⤵
                                                                                PID:3644
                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                  7⤵
                                                                                    PID:5916
                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                      8⤵
                                                                                        PID:17600
                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                      7⤵
                                                                                        PID:9300
                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                        7⤵
                                                                                          PID:16132
                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                        6⤵
                                                                                          PID:4896
                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                            7⤵
                                                                                              PID:9432
                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                              7⤵
                                                                                                PID:15172
                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                              6⤵
                                                                                                PID:7316
                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                6⤵
                                                                                                  PID:14064
                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                5⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:1292
                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                  6⤵
                                                                                                    PID:1044
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                      7⤵
                                                                                                        PID:3484
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                          8⤵
                                                                                                            PID:5376
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                              9⤵
                                                                                                                PID:12640
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                              8⤵
                                                                                                                PID:8728
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                8⤵
                                                                                                                  PID:13384
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                7⤵
                                                                                                                  PID:4548
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                    8⤵
                                                                                                                      PID:8536
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                      8⤵
                                                                                                                        PID:13068
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                      7⤵
                                                                                                                        PID:6944
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                          8⤵
                                                                                                                            PID:1796
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                          7⤵
                                                                                                                            PID:13216
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                          6⤵
                                                                                                                            PID:3508
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                              7⤵
                                                                                                                                PID:5460
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                  8⤵
                                                                                                                                    PID:12612
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                  7⤵
                                                                                                                                    PID:8392
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                    7⤵
                                                                                                                                      PID:14916
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:4540
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:8876
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                          7⤵
                                                                                                                                            PID:16540
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:6800
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                              7⤵
                                                                                                                                                PID:13704
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:13560
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:2172
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                  6⤵
                                                                                                                                                    PID:3520
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                      7⤵
                                                                                                                                                        PID:5600
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                          8⤵
                                                                                                                                                            PID:13816
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                          7⤵
                                                                                                                                                            PID:8720
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                            7⤵
                                                                                                                                                              PID:13200
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4588
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:8552
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                  7⤵
                                                                                                                                                                    PID:15088
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:6984
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:12796
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:3588
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:5756
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:13864
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:9256
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:15124
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:4692
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:9340
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:16308
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:7160
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:13628
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                      PID:2800
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                        5⤵
                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                        PID:2652
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:600
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:3944
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:6872
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                      PID:12968
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:5436
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                          PID:12572
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:8376
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:13808
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:3692
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:5156
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:18408
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                    PID:9324
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                      PID:15344
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                          PID:10540
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                            PID:19368
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:7452
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:14344
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:2788
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                      PID:7260
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                        PID:13872
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                        PID:6036
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                            PID:13832
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                            PID:9284
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:16156
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                              PID:3884
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                  PID:6820
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                      PID:14288
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:12620
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:5388
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                          PID:13788
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:8344
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:13208
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                              PID:3076
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                      PID:9676
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                        PID:15056
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:7300
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                          PID:13712
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                          PID:4384
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:8200
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:14900
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:6292
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:2836
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                    PID:10360
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                      PID:16200
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:2708
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                          PID:4292
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                              PID:7284
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                PID:13620
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                    PID:13912
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                    PID:9352
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                      PID:16180
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:3892
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:6860
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:13984
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:5396
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                PID:12772
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:8384
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:16172
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                PID:2532
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                  PID:376
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:1928
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:3352
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                              PID:5260
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                  PID:10432
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                    PID:19056
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                    PID:7792
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                      PID:13140
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                      PID:4476
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                          PID:8444
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:14440
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                            PID:6544
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                PID:1980
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                PID:10448
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                  PID:20180
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                          PID:10352
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:19064
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7636
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:14000
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4440
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:8544
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:15616
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:6576
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:836
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:10424
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:18792
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                        PID:2900
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3216
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5244
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:9660
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:12836
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7652
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:13944
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4492
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:8256
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:14368
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6584
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:20884
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:10416
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:18268
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:10284
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:18572
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:7396
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:17660
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14264
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8288
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13604
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6624
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:18580
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10292
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:19324
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:280
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7496
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14328
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6284
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10160
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:15712
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7112
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:14132
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14296
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9292
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:16300
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:17668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:18416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:13848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:16268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:15080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:15420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:20756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:18596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:15212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:19360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:15220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:14280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:16164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:18556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:16596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:17916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:19932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:15064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:15072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:19924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:19392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:14596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:20592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:18548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:18424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:20208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:18664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:14256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:13180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:19916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:16192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:14008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:18436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:19384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:18604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:17356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:15704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:14016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:13968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:13644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:16216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:14272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:13032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\06edd2ca69da2d38c37a2582141f51f0N.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8360

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Windows Sidebar\Shared Gadgets\kicking horse girls swallow (Jenna).rar.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2bd1ac8212c65e7b1bb41cf0636e3e2d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c580af3a46baffb4163462409a4088959e28d6da

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ee25c8e8710cec607fb6a4a721ffc56a8877650aafe50568c3d9363dfb087384

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                331f55c5a20df5b9facc414c4aa62cb3cc89203ed21b9a3c4bfb54afc7df9010e272f6df6fce11be28ce6cc37a2925c776e3d29a331fab46ff9261bfbf17f5de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\debug.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                183B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                52bc30373962b2b1cadfd01abec3de89

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                c82f084d314848b7e8ef95954002687bba21712e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7a1cc178433d03c3a5a971d1d7b4342331c5f04999905edd991d17407fde76b9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                ed0494c6151095540787196838adcf08c335f886210a8391c84d5fd48f8bf93b42d3477a3c1a59f98dcd806e9fa4eac8eb8f93bd01d528db9846f715813cdc61

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Download Submit