3c4476ec7928fc47cc60464820e3001ad97fd308b0e1a041dc4d83aa67155dc2

Analysis

max time kernel
10s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d86af121985edd6ec8f4e02ee37fbb0N.exe
Size

1.3MB
MD5

0d86af121985edd6ec8f4e02ee37fbb0
SHA1

902b9d7b616c9d3a78c098c965bd7b8e31f73d05
SHA256

3c4476ec7928fc47cc60464820e3001ad97fd308b0e1a041dc4d83aa67155dc2
SHA512

fbf898b9a2d9506e9518eb48b94e37449ee871c47281953630d1e6c18fa17f69441612506c9a1d0af8ba819245f281d70fd4eb3c55822b8988001739ef123cc4
SSDEEP

24576:sWm34bGD+aybXCdfrfcfkoq5xiFfv2SnceFJ7E4Aan+S7mAkNeEDt7nuvGtaoqAd:BmI6SaRlrfcfkt5wtE9m7PkNeEDtjWqV

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\U:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\H:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\J:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\M:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\O:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\P:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\R:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\V:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\I:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\G:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\N:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\S:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\T:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\W:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\X:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\B:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\E:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\K:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\Q:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\Y:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\Z:	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File opened (read-only)	\??\A:	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\asian fucking fucking masturbation feet .zip.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\dotnet\shared\fucking sperm voyeur girly .rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia blowjob cumshot girls feet .avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Google\Temp\tyrkish blowjob uncut cock traffic (Sylvia).rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\porn uncut sweet (Kathrin,Sandy).avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\horse blowjob hidden nipples .mpg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\japanese nude sperm girls legs (Liz).rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\beast handjob uncut ash (Sandy).mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\indian handjob animal several models .mpg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\cum sperm girls titts .mpg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\gay voyeur .rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\xxx [free] .mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\norwegian lesbian [milf] cock (Ashley).avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\american cumshot [milf] 40+ (Britney).rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\sperm blowjob public titts sm .zip.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Google\Update\Download\russian animal bukkake hot (!) leather .rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\cum catfight penetration .mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\fetish lingerie several models titts .mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\french animal hardcore several models hole (Anniston,Sandy).rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\american lesbian cumshot girls .rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian beast horse public (Sylvia,Jade).mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\security\templates\hardcore fucking girls boobs .zip.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\russian fetish big swallow .mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\japanese trambling licking nipples fishy .zip.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\Downloaded Program Files\gay hot (!) ash (Janette,Jade).avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lingerie beastiality full movie leather (Ashley).rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\beastiality full movie hole .avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\PLA\Templates\cum horse licking black hairunshaved .zip.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\mssrv.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\british lingerie lesbian blondie (Sandy).mpg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\assembly\temp\canadian cum hidden .avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\assembly\tmp\german handjob bukkake uncut bedroom .rar.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\InputMethod\SHARED\italian action girls Ôï .avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\african action hidden pregnant (Samantha).zip.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\swedish horse licking ash .avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\CbsTemp\french lingerie uncut leather .mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\nude hardcore hidden boobs femdom .avi.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\fetish masturbation bedroom (Sarah).mpg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\american beastiality beast several models .mpeg.exe	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d86af121985edd6ec8f4e02ee37fbb0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe
1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3800	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3800	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
2640	0d86af121985edd6ec8f4e02ee37fbb0N.exe
2640	0d86af121985edd6ec8f4e02ee37fbb0N.exe
1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe
1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe
1168	0d86af121985edd6ec8f4e02ee37fbb0N.exe
1168	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe
324	0d86af121985edd6ec8f4e02ee37fbb0N.exe
324	0d86af121985edd6ec8f4e02ee37fbb0N.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 1944	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	88
PID 3488 wrote to memory of 1944	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	88
PID 3488 wrote to memory of 1944	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	88
PID 3488 wrote to memory of 3800	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	89
PID 3488 wrote to memory of 3800	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	89
PID 3488 wrote to memory of 3800	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	89
PID 1944 wrote to memory of 2640	1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe	90
PID 1944 wrote to memory of 2640	1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe	90
PID 1944 wrote to memory of 2640	1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe	90
PID 3488 wrote to memory of 1168	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	94
PID 3488 wrote to memory of 1168	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	94
PID 3488 wrote to memory of 1168	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	94
PID 1944 wrote to memory of 324	1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe	95
PID 1944 wrote to memory of 324	1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe	95
PID 1944 wrote to memory of 324	1944	0d86af121985edd6ec8f4e02ee37fbb0N.exe	95
PID 3800 wrote to memory of 4580	3800	0d86af121985edd6ec8f4e02ee37fbb0N.exe	97
PID 3800 wrote to memory of 4580	3800	0d86af121985edd6ec8f4e02ee37fbb0N.exe	97
PID 3800 wrote to memory of 4580	3800	0d86af121985edd6ec8f4e02ee37fbb0N.exe	97
PID 2640 wrote to memory of 908	2640	0d86af121985edd6ec8f4e02ee37fbb0N.exe	98
PID 2640 wrote to memory of 908	2640	0d86af121985edd6ec8f4e02ee37fbb0N.exe	98
PID 2640 wrote to memory of 908	2640	0d86af121985edd6ec8f4e02ee37fbb0N.exe	98
PID 3488 wrote to memory of 1148	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	99
PID 3488 wrote to memory of 1148	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	99
PID 3488 wrote to memory of 1148	3488	0d86af121985edd6ec8f4e02ee37fbb0N.exe	99
PID 1168 wrote to memory of 2780	1168	0d86af121985edd6ec8f4e02ee37fbb0N.exe	100
PID 1168 wrote to memory of 2780	1168	0d86af121985edd6ec8f4e02ee37fbb0N.exe	100
PID 1168 wrote to memory of 2780	1168	0d86af121985edd6ec8f4e02ee37fbb0N.exe	100

C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
"C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:18600
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14620
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:18288
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:464
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:7932
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5468
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:324
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:18712
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:18888
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:17680
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:13360
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12936
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:2432
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:18816
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:18728
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12736
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13588
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8512
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:10708
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:14884
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12344
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:16692
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:11272
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:15524
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        7⤵
        
        PID:2444
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:18720
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14612
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:14224
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12260
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:16892
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:16636
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:17852
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12884
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:960
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:13456
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:880
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:16912
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:6356
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:11844
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:16052
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12716
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:13144
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:14204
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:17176
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:7600
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:12124
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:13980
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        6⤵
        
        PID:16676
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:16208
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:3984
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:15092
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12352
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:17212
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:16752
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:11528
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:15556
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
        5⤵
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:14196
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:12504
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:5872
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:2164
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:15380
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:5288
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
      4⤵
      PID:14652
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:9580
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:13032
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:17928
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:6552
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:11852
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:15952
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:8316
- - C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
    3⤵
    PID:4244
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:10832
- C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe
  "C:\Users\Admin\AppData\Local\Temp\0d86af121985edd6ec8f4e02ee37fbb0N.exe"
  2⤵
  PID:15084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\malaysia blowjob cumshot girls feet .avi.exe

Filesize
1.2MB

MD5
aba3713763b5da62e5924819375a228f

SHA1
f727614afaa1f6a3c5539c3f375e1790765d60fc

SHA256
bd4a690fdbd40b86494110011468dbadbe8538ec0593b106effa18a5f295af7b

SHA512
5beb7dd5221db69337129c92077a57633f53cc092ec8f04dfadea15d1c0c7fb9b70aa5e2c778dd18e7e2dbf1a46acb8bcf453f40bc85684dd573e445ecf0ff6b

Download Submit