37382933ddeaefe8cc80a41ce5ff7b26a0c009bc65fc7e95763fca1b61b41b94

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b92b325725b1efd44ccdbbfde072b840N.exe
Size

1.2MB
MD5

b92b325725b1efd44ccdbbfde072b840
SHA1

3c0df570b7c8d268422840e3e39afda25d7c71e5
SHA256

37382933ddeaefe8cc80a41ce5ff7b26a0c009bc65fc7e95763fca1b61b41b94
SHA512

02b3f3283da21c7337581b4033cc45a66fb9b34f0a7d5cbeb1376ee8524a38df9a27d7b95cbbf259c1ac12c60833a4984fb14ca11f8408d7c4f91a5c886dcb46
SSDEEP

24576:oWLJPwRN70dr9+IKSbwhkgL+VR7ixd9mPD/wX7BpLlgPqw8HCcT:V9w7odrkSwhrA7iNeDclQqlHCcT

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	b92b325725b1efd44ccdbbfde072b840N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\I:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\Q:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\R:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\Z:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\A:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\B:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\N:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\O:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\S:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\T:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\W:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\X:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\J:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\L:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\M:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\P:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\K:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\U:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\V:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\Y:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\G:	b92b325725b1efd44ccdbbfde072b840N.exe
File opened (read-only)	\??\H:	b92b325725b1efd44ccdbbfde072b840N.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\horse action several models titts redhair .mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\black bukkake gay girls .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\tyrkish beast fucking [free] .mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\fucking girls titts femdom .rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\gay [milf] hairy (Jade,Sarah).mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\russian xxx several models (Sandy,Kathrin).rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\italian sperm sleeping hotel (Sonja).mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\british horse kicking several models feet sweet (Liz,Jade).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\russian trambling catfight stockings .mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Google\Update\Download\brasilian lingerie lesbian .mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\tyrkish horse xxx [milf] ash (Sylvia,Britney).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\french gang bang nude big circumcision .zip.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\chinese lesbian bukkake girls glans lady .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\german action lesbian boobs blondie .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files\Windows Journal\Templates\japanese hardcore hidden latex .mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Google\Temp\american gay xxx licking fishy .mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\horse catfight glans bondage .zip.exe	b92b325725b1efd44ccdbbfde072b840N.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\malaysia trambling gang bang public penetration .rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\Downloaded Program Files\gay handjob sleeping .rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\security\templates\hardcore fetish voyeur (Sandy,Sonja).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\cum nude public .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\animal fetish licking hole mistress .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\german lesbian bukkake licking mistress .zip.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\beast several models titts bondage (Anniston,Sarah).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\russian lingerie big hole (Jade).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black trambling sleeping .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\action licking shower .rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\temp\nude hot (!) boobs .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\spanish lingerie beast licking .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\beast big ash (Ashley,Anniston).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\norwegian fetish several models hotel .zip.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm gang bang uncut 50+ .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\british kicking fetish sleeping sweet .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\PLA\Templates\spanish porn lesbian black hairunshaved (Britney,Karin).mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\mssrv.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian gay public 40+ .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\cum cumshot several models hole .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\bukkake porn [free] sm .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\malaysia bukkake hardcore uncut bedroom .rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\lingerie licking balls (Karin).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\danish horse blowjob big castration .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\japanese cum cumshot full movie .avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\norwegian beastiality action hidden feet .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\SoftwareDistribution\Download\malaysia lingerie catfight legs sm .zip.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\beastiality fetish big .rar.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\assembly\tmp\american lingerie public ash .mpg.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\norwegian handjob hot (!) YEâPSè& (Curtney).avi.exe	b92b325725b1efd44ccdbbfde072b840N.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\nude girls 50+ (Karin,Ashley).mpeg.exe	b92b325725b1efd44ccdbbfde072b840N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b92b325725b1efd44ccdbbfde072b840N.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3008	b92b325725b1efd44ccdbbfde072b840N.exe
1492	b92b325725b1efd44ccdbbfde072b840N.exe
3008	b92b325725b1efd44ccdbbfde072b840N.exe
2968	b92b325725b1efd44ccdbbfde072b840N.exe
588	b92b325725b1efd44ccdbbfde072b840N.exe
1492	b92b325725b1efd44ccdbbfde072b840N.exe
3008	b92b325725b1efd44ccdbbfde072b840N.exe
2616	b92b325725b1efd44ccdbbfde072b840N.exe
2624	b92b325725b1efd44ccdbbfde072b840N.exe
2676	b92b325725b1efd44ccdbbfde072b840N.exe
2636	b92b325725b1efd44ccdbbfde072b840N.exe
2968	b92b325725b1efd44ccdbbfde072b840N.exe
3008	b92b325725b1efd44ccdbbfde072b840N.exe
588	b92b325725b1efd44ccdbbfde072b840N.exe
1492	b92b325725b1efd44ccdbbfde072b840N.exe
2968	b92b325725b1efd44ccdbbfde072b840N.exe
1108	b92b325725b1efd44ccdbbfde072b840N.exe
2624	b92b325725b1efd44ccdbbfde072b840N.exe
1688	b92b325725b1efd44ccdbbfde072b840N.exe
2676	b92b325725b1efd44ccdbbfde072b840N.exe
1492	b92b325725b1efd44ccdbbfde072b840N.exe
332	b92b325725b1efd44ccdbbfde072b840N.exe
588	b92b325725b1efd44ccdbbfde072b840N.exe
3008	b92b325725b1efd44ccdbbfde072b840N.exe
1320	b92b325725b1efd44ccdbbfde072b840N.exe
276	b92b325725b1efd44ccdbbfde072b840N.exe
1712	b92b325725b1efd44ccdbbfde072b840N.exe
2616	b92b325725b1efd44ccdbbfde072b840N.exe
1812	b92b325725b1efd44ccdbbfde072b840N.exe
2580	b92b325725b1efd44ccdbbfde072b840N.exe
2636	b92b325725b1efd44ccdbbfde072b840N.exe
2868	b92b325725b1efd44ccdbbfde072b840N.exe
2284	b92b325725b1efd44ccdbbfde072b840N.exe
1048	b92b325725b1efd44ccdbbfde072b840N.exe
2624	b92b325725b1efd44ccdbbfde072b840N.exe
2968	b92b325725b1efd44ccdbbfde072b840N.exe
1108	b92b325725b1efd44ccdbbfde072b840N.exe
324	b92b325725b1efd44ccdbbfde072b840N.exe
2784	b92b325725b1efd44ccdbbfde072b840N.exe
2676	b92b325725b1efd44ccdbbfde072b840N.exe
1688	b92b325725b1efd44ccdbbfde072b840N.exe
2228	b92b325725b1efd44ccdbbfde072b840N.exe
804	b92b325725b1efd44ccdbbfde072b840N.exe
1492	b92b325725b1efd44ccdbbfde072b840N.exe
588	b92b325725b1efd44ccdbbfde072b840N.exe
276	b92b325725b1efd44ccdbbfde072b840N.exe
1320	b92b325725b1efd44ccdbbfde072b840N.exe
1812	b92b325725b1efd44ccdbbfde072b840N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1492	3008	b92b325725b1efd44ccdbbfde072b840N.exe	29
PID 3008 wrote to memory of 1492	3008	b92b325725b1efd44ccdbbfde072b840N.exe	29
PID 3008 wrote to memory of 1492	3008	b92b325725b1efd44ccdbbfde072b840N.exe	29
PID 3008 wrote to memory of 1492	3008	b92b325725b1efd44ccdbbfde072b840N.exe	29
PID 3008 wrote to memory of 2968	3008	b92b325725b1efd44ccdbbfde072b840N.exe	30
PID 3008 wrote to memory of 2968	3008	b92b325725b1efd44ccdbbfde072b840N.exe	30
PID 3008 wrote to memory of 2968	3008	b92b325725b1efd44ccdbbfde072b840N.exe	30
PID 3008 wrote to memory of 2968	3008	b92b325725b1efd44ccdbbfde072b840N.exe	30
PID 1492 wrote to memory of 588	1492	b92b325725b1efd44ccdbbfde072b840N.exe	31
PID 1492 wrote to memory of 588	1492	b92b325725b1efd44ccdbbfde072b840N.exe	31
PID 1492 wrote to memory of 588	1492	b92b325725b1efd44ccdbbfde072b840N.exe	31
PID 1492 wrote to memory of 588	1492	b92b325725b1efd44ccdbbfde072b840N.exe	31
PID 2968 wrote to memory of 2616	2968	b92b325725b1efd44ccdbbfde072b840N.exe	32
PID 2968 wrote to memory of 2616	2968	b92b325725b1efd44ccdbbfde072b840N.exe	32
PID 2968 wrote to memory of 2616	2968	b92b325725b1efd44ccdbbfde072b840N.exe	32
PID 2968 wrote to memory of 2616	2968	b92b325725b1efd44ccdbbfde072b840N.exe	32
PID 1492 wrote to memory of 2624	1492	b92b325725b1efd44ccdbbfde072b840N.exe	33
PID 1492 wrote to memory of 2624	1492	b92b325725b1efd44ccdbbfde072b840N.exe	33
PID 1492 wrote to memory of 2624	1492	b92b325725b1efd44ccdbbfde072b840N.exe	33
PID 1492 wrote to memory of 2624	1492	b92b325725b1efd44ccdbbfde072b840N.exe	33
PID 3008 wrote to memory of 2636	3008	b92b325725b1efd44ccdbbfde072b840N.exe	34
PID 3008 wrote to memory of 2636	3008	b92b325725b1efd44ccdbbfde072b840N.exe	34
PID 3008 wrote to memory of 2636	3008	b92b325725b1efd44ccdbbfde072b840N.exe	34
PID 3008 wrote to memory of 2636	3008	b92b325725b1efd44ccdbbfde072b840N.exe	34
PID 588 wrote to memory of 2676	588	b92b325725b1efd44ccdbbfde072b840N.exe	35
PID 588 wrote to memory of 2676	588	b92b325725b1efd44ccdbbfde072b840N.exe	35
PID 588 wrote to memory of 2676	588	b92b325725b1efd44ccdbbfde072b840N.exe	35
PID 588 wrote to memory of 2676	588	b92b325725b1efd44ccdbbfde072b840N.exe	35
PID 2968 wrote to memory of 332	2968	b92b325725b1efd44ccdbbfde072b840N.exe	36
PID 2968 wrote to memory of 332	2968	b92b325725b1efd44ccdbbfde072b840N.exe	36
PID 2968 wrote to memory of 332	2968	b92b325725b1efd44ccdbbfde072b840N.exe	36
PID 2968 wrote to memory of 332	2968	b92b325725b1efd44ccdbbfde072b840N.exe	36
PID 2624 wrote to memory of 1108	2624	b92b325725b1efd44ccdbbfde072b840N.exe	37
PID 2624 wrote to memory of 1108	2624	b92b325725b1efd44ccdbbfde072b840N.exe	37
PID 2624 wrote to memory of 1108	2624	b92b325725b1efd44ccdbbfde072b840N.exe	37
PID 2624 wrote to memory of 1108	2624	b92b325725b1efd44ccdbbfde072b840N.exe	37
PID 3008 wrote to memory of 1320	3008	b92b325725b1efd44ccdbbfde072b840N.exe	38
PID 3008 wrote to memory of 1320	3008	b92b325725b1efd44ccdbbfde072b840N.exe	38
PID 3008 wrote to memory of 1320	3008	b92b325725b1efd44ccdbbfde072b840N.exe	38
PID 3008 wrote to memory of 1320	3008	b92b325725b1efd44ccdbbfde072b840N.exe	38
PID 2676 wrote to memory of 1712	2676	b92b325725b1efd44ccdbbfde072b840N.exe	40
PID 2676 wrote to memory of 1712	2676	b92b325725b1efd44ccdbbfde072b840N.exe	40
PID 2676 wrote to memory of 1712	2676	b92b325725b1efd44ccdbbfde072b840N.exe	40
PID 2676 wrote to memory of 1712	2676	b92b325725b1efd44ccdbbfde072b840N.exe	40
PID 2616 wrote to memory of 1688	2616	b92b325725b1efd44ccdbbfde072b840N.exe	39
PID 2616 wrote to memory of 1688	2616	b92b325725b1efd44ccdbbfde072b840N.exe	39
PID 2616 wrote to memory of 1688	2616	b92b325725b1efd44ccdbbfde072b840N.exe	39
PID 2616 wrote to memory of 1688	2616	b92b325725b1efd44ccdbbfde072b840N.exe	39
PID 1492 wrote to memory of 276	1492	b92b325725b1efd44ccdbbfde072b840N.exe	41
PID 1492 wrote to memory of 276	1492	b92b325725b1efd44ccdbbfde072b840N.exe	41
PID 1492 wrote to memory of 276	1492	b92b325725b1efd44ccdbbfde072b840N.exe	41
PID 1492 wrote to memory of 276	1492	b92b325725b1efd44ccdbbfde072b840N.exe	41
PID 588 wrote to memory of 2580	588	b92b325725b1efd44ccdbbfde072b840N.exe	42
PID 588 wrote to memory of 2580	588	b92b325725b1efd44ccdbbfde072b840N.exe	42
PID 588 wrote to memory of 2580	588	b92b325725b1efd44ccdbbfde072b840N.exe	42
PID 588 wrote to memory of 2580	588	b92b325725b1efd44ccdbbfde072b840N.exe	42
PID 2636 wrote to memory of 1812	2636	b92b325725b1efd44ccdbbfde072b840N.exe	43
PID 2636 wrote to memory of 1812	2636	b92b325725b1efd44ccdbbfde072b840N.exe	43
PID 2636 wrote to memory of 1812	2636	b92b325725b1efd44ccdbbfde072b840N.exe	43
PID 2636 wrote to memory of 1812	2636	b92b325725b1efd44ccdbbfde072b840N.exe	43
PID 2968 wrote to memory of 2868	2968	b92b325725b1efd44ccdbbfde072b840N.exe	44
PID 2968 wrote to memory of 2868	2968	b92b325725b1efd44ccdbbfde072b840N.exe	44
PID 2968 wrote to memory of 2868	2968	b92b325725b1efd44ccdbbfde072b840N.exe	44
PID 2968 wrote to memory of 2868	2968	b92b325725b1efd44ccdbbfde072b840N.exe	44

C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
"C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:1716
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:12568
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:4620
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:11204
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:764
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11172
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:9692
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:276
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4628
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6388
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:11164
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:12592
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:10480
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4100
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:10784
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:11140
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:7748
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:11156
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        7⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11972
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4044
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:8636
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:332
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:9824
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11196
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:10808
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:12576
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:11988
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:7304
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:7340
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:6972
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:7976
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        6⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:2852
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:10000
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5820
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:8684
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:11076
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:308
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3180
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
        5⤵
        
        PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:8568
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:12272
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6252
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:9860
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:2464
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:8820
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:7492
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:2144
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  PID:1248
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
      "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
      4⤵
      PID:8376
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:8752
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  PID:3968
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
    "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
    3⤵
    PID:11124
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  PID:7328
- C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe
  "C:\Users\Admin\AppData\Local\Temp\b92b325725b1efd44ccdbbfde072b840N.exe"
  2⤵
  PID:11956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\british horse kicking several models feet sweet (Liz,Jade).avi.exe

Filesize
545KB

MD5
61f31cc2b9455fece6c7f561c1440b8b

SHA1
3bda4ddc4725dba53c687a1ff931809a822af3e9

SHA256
122eb805aaf44cd63d9086f864ba99e990e6bbffbf2addc619a144c0b51053a3

SHA512
a2accc11d569a6b02e0efbb485e1147ee2d683ebfd2ad299b4188a77ad2d29f6e8213f435aa841854f8fccd6786a91b4310c211cf94187b092baad1aed519096

Download Submit
memory/276-186-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/276-99-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/276-140-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/308-113-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/308-165-0x0000000004590000-0x00000000045BB000-memory.dmp

Filesize
172KB

Download
memory/324-153-0x0000000000550000-0x000000000057B000-memory.dmp

Filesize
172KB

Download
memory/324-192-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/324-107-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/332-155-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/332-115-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/332-95-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/588-46-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/588-173-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/804-159-0x0000000004830000-0x000000000485B000-memory.dmp

Filesize
172KB

Download
memory/804-110-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/816-174-0x0000000004810000-0x000000000483B000-memory.dmp

Filesize
172KB

Download
memory/1044-112-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1044-163-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/1048-136-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/1048-105-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1048-190-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1108-93-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1108-182-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1108-135-0x00000000045E0000-0x000000000460B000-memory.dmp

Filesize
172KB

Download
memory/1108-162-0x0000000004950000-0x000000000497B000-memory.dmp

Filesize
172KB

Download
memory/1320-185-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1320-98-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1320-141-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/1488-120-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1492-74-0x0000000004410000-0x000000000443B000-memory.dmp

Filesize
172KB

Download
memory/1492-169-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1492-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1492-44-0x0000000004410000-0x000000000443B000-memory.dmp

Filesize
172KB

Download
memory/1492-139-0x0000000004810000-0x000000000483B000-memory.dmp

Filesize
172KB

Download
memory/1492-172-0x0000000004410000-0x000000000443B000-memory.dmp

Filesize
172KB

Download
memory/1688-94-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1712-114-0x00000000047C0000-0x00000000047EB000-memory.dmp

Filesize
172KB

Download
memory/1712-183-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1712-96-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1712-154-0x0000000004920000-0x000000000494B000-memory.dmp

Filesize
172KB

Download
memory/1764-116-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1812-187-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1812-142-0x0000000004930000-0x000000000495B000-memory.dmp

Filesize
172KB

Download
memory/1812-100-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1820-119-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1820-168-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/2140-111-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2228-194-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2228-109-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2228-158-0x0000000004A50000-0x0000000004A7B000-memory.dmp

Filesize
172KB

Download
memory/2284-191-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2284-137-0x0000000004910000-0x000000000493B000-memory.dmp

Filesize
172KB

Download
memory/2284-106-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2300-118-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2580-97-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2580-184-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2580-156-0x00000000045E0000-0x000000000460B000-memory.dmp

Filesize
172KB

Download
memory/2616-146-0x0000000004930000-0x000000000495B000-memory.dmp

Filesize
172KB

Download
memory/2616-77-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-178-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2624-92-0x00000000047E0000-0x000000000480B000-memory.dmp

Filesize
172KB

Download
memory/2624-181-0x00000000047E0000-0x000000000480B000-memory.dmp

Filesize
172KB

Download
memory/2624-76-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2624-177-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2624-104-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/2636-79-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2636-180-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2636-117-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/2676-179-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2676-138-0x0000000004510000-0x000000000453B000-memory.dmp

Filesize
172KB

Download
memory/2676-78-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2784-193-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2784-157-0x00000000047C0000-0x00000000047EB000-memory.dmp

Filesize
172KB

Download
memory/2784-108-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2868-189-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2868-103-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2868-160-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/2968-45-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2968-175-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/2968-134-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/2968-91-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/2968-188-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/2968-171-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2968-73-0x00000000047D0000-0x00000000047FB000-memory.dmp

Filesize
172KB

Download
memory/2968-102-0x0000000004A60000-0x0000000004A8B000-memory.dmp

Filesize
172KB

Download
memory/2968-161-0x0000000004A70000-0x0000000004A9B000-memory.dmp

Filesize
172KB

Download
memory/3008-176-0x0000000004AE0000-0x0000000004B0B000-memory.dmp

Filesize
172KB

Download
memory/3008-144-0x0000000004AF0000-0x0000000004B1B000-memory.dmp

Filesize
172KB

Download
memory/3008-75-0x0000000004AE0000-0x0000000004B0B000-memory.dmp

Filesize
172KB

Download
memory/3008-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3008-170-0x0000000004AE0000-0x0000000004B0B000-memory.dmp

Filesize
172KB

Download
memory/3008-167-0x0000000004AE0000-0x0000000004B0B000-memory.dmp

Filesize
172KB

Download
memory/3008-166-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3008-43-0x0000000004AE0000-0x0000000004B0B000-memory.dmp

Filesize
172KB

Download
memory/3008-15-0x0000000004AE0000-0x0000000004B0B000-memory.dmp

Filesize
172KB

Download
memory/3100-164-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download