svcstealer | 19fd8d2a1d4eb4761553c6ea75320b09f5085e33c5d3702ef9a3d6aff7abbe4a

Analysis

max time kernel
13s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CookieSentinel.exe
Size 80.2MB
Sample260816-e4sqyabc28
SHA256 19fd8d2a1d4eb4761553c6ea75320b09f5085e33c5d3702ef9a3d6aff7abbe4a
MD5 a8c3008e9514a1add0a6e35e2a5f03bb
SHA1 cae75e6477f5c81efa7cc1b0da074e55c011f9c2
SHA512 81f607c86aa319a0d7b9d7a9984b86d177e4878c845a78065bf4875ffaa80ced6cc1c108ddc5bbe02f4642f9f3953f210699cf7d20b2d1a6e8747795cd154917
SSDEEP 1572864:vLDkoDCbaz6Ex9lA51UHAs7FcV4cM4BTUmcuL2Gv6B07FyK2r:vLDkoDcieGgsBo5CH8GgpK
TLSH
T18D0833F852445A6EE2E15236FA2E02B0D6B0BA25A8C7C6FAED9743C5CD33345853DF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery downloader execution svcstealer persistence spyware stealer

Malware Config

Signatures

Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer

Detects SvcStealer Payload 2 IoCs

SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

resource	yara_rule
behavioral2/files/0x000d00000001c612-4.dat	family_svcstealer
behavioral2/files/0x000c00000001c617-32.dat	family_svcstealer

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
4716	g7x3qys3.exe
2608	fr8juhy7.exe
5620	iteuqc1j.exe
1824	fqxo4qtq.exe
4088	1rht1ds2.exe
3348	2vou07tr.exe
5636	wlrmdr.exe
5664	msedgeupdatecdl.exe
6480	1rht1ds2.exe
4356	g7x3qys3.exe
3388	fr8juhy7.exe
2204	iteuqc1j.exe
4120	fqxo4qtq.exe
1636	1rht1ds2.exe
4972	2vou07tr.exe
3776	g7x3qys3.exe
3656	fr8juhy7.exe
3872	iteuqc1j.exe
3036	fqxo4qtq.exe
1496	1rht1ds2.exe
7064	2vou07tr.exe
6492	apza.exe
1348	g7x3qys3.exe
4128	fr8juhy7.exe
1376	iteuqc1j.exe
4332	fqxo4qtq.exe
3344	1rht1ds2.exe
4572	2vou07tr.exe
1776	g7x3qys3.exe
2768	fr8juhy7.exe
2724	iteuqc1j.exe
1664	fqxo4qtq.exe
108	1rht1ds2.exe
692	g7x3qys3.exe
2632	fr8juhy7.exe
7096	iteuqc1j.exe
1864	fqxo4qtq.exe
5128	1rht1ds2.exe
2480	2vou07tr.exe
2556	g7x3qys3.exe
2356	fr8juhy7.exe
3048	iteuqc1j.exe
5668	fqxo4qtq.exe
2880	1rht1ds2.exe
6036	2vou07tr.exe
4112	g7x3qys3.exe
6664	fr8juhy7.exe
1436	iteuqc1j.exe
3716	fqxo4qtq.exe
5196	1rht1ds2.exe
5560	2vou07tr.exe
4792	apza.exe
5332	g7x3qys3.exe
3656	fr8juhy7.exe
3036	iteuqc1j.exe
6520	fqxo4qtq.exe
1820	1rht1ds2.exe
7136	2vou07tr.exe
2884	g7x3qys3.exe
5136	fr8juhy7.exe
4856	iteuqc1j.exe
3248	fqxo4qtq.exe
3924	1rht1ds2.exe
1760	2vou07tr.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\apza.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Vyon\\apza.exe"	apza.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\msedgeupdatecdl.exe"	fqxo4qtq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1rht1ds2.exe"	1rht1ds2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4088 set thread context of 4400	4088	1rht1ds2.exe	59
PID 6480 set thread context of 4400	6480	1rht1ds2.exe	59
PID 1636 set thread context of 4400	1636	1rht1ds2.exe	59
PID 1496 set thread context of 4400	1496	1rht1ds2.exe	59
PID 3344 set thread context of 4400	3344	1rht1ds2.exe	59
PID 108 set thread context of 4400	108	1rht1ds2.exe	59
PID 5128 set thread context of 4400	5128	1rht1ds2.exe	59
PID 2880 set thread context of 4400	2880	1rht1ds2.exe	1054
PID 5196 set thread context of 4400	5196	1rht1ds2.exe	1054
PID 1820 set thread context of 4400	1820	1rht1ds2.exe	1054
PID 3924 set thread context of 4400	3924	1rht1ds2.exe	1054
PID 5040 set thread context of 4400	5040	1rht1ds2.exe	1054
PID 5128 set thread context of 4400	5128	1rht1ds2.exe	1054

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
9940	Process not Found
6964	cmd.exe
748	cmd.exe
7364	cmd.exe
4932	cmd.exe
6428	cmd.exe
8060	cmd.exe
9064	Process not Found
9872	Process not Found
912	cmd.exe
5668	cmd.exe
7216	cmd.exe
2148	cmd.exe
7844	cmd.exe
3948	Process not Found
8384	Process not Found
7272	Process not Found
3464	cmd.exe
6232	cmd.exe
7852	cmd.exe
5948	cmd.exe
9092	Process not Found
6092	Process not Found
2160	Process not Found
10020	Process not Found
8004	cmd.exe
7984	Process not Found
6048	Process not Found
6524	Process not Found
2344	Process not Found
7300	cmd.exe
9144	Process not Found
8808	Process not Found
6092	cmd.exe
2324	cmd.exe
6664	cmd.exe
9644	Process not Found
1208	cmd.exe
5580	cmd.exe
4376	cmd.exe
6796	cmd.exe
2068	cmd.exe
7764	cmd.exe
8072	cmd.exe
8536	Process not Found
4728	cmd.exe
2976	cmd.exe
7556	cmd.exe
7480	cmd.exe
6504	cmd.exe
5864	cmd.exe
5108	cmd.exe
7236	Process not Found
4616	cmd.exe
6332	cmd.exe
5908	cmd.exe
8712	Process not Found
2464	Process not Found
8908	Process not Found
7864	Process not Found
7272	Process not Found
1396	cmd.exe
1072	cmd.exe
7204	cmd.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
2608	fr8juhy7.exe
2608	fr8juhy7.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe
4716	g7x3qys3.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeSecurityPrivilege	3348	2vou07tr.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe
Token: SeShutdownPrivilege	2240	explorer.exe
Token: SeCreatePagefilePrivilege	2240	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 4716	5328	CookieSentinel.exe	88
PID 5328 wrote to memory of 2608	5328	CookieSentinel.exe	89
PID 2608 wrote to memory of 4400	2608	fr8juhy7.exe	59
PID 2608 wrote to memory of 4468	2608	fr8juhy7.exe	60
PID 2608 wrote to memory of 2840	2608	fr8juhy7.exe	79
PID 2608 wrote to memory of 2240	2608	fr8juhy7.exe	80
PID 5328 wrote to memory of 5620	5328	CookieSentinel.exe	90
PID 5328 wrote to memory of 1824	5328	CookieSentinel.exe	92
PID 5328 wrote to memory of 4088	5328	CookieSentinel.exe	93
PID 2240 wrote to memory of 4464	2240	explorer.exe
PID 2240 wrote to memory of 6904	2240	explorer.exe
PID 2240 wrote to memory of 6900	2240	explorer.exe
PID 4088 wrote to memory of 4400	4088	1rht1ds2.exe	59
PID 5328 wrote to memory of 3348	5328	CookieSentinel.exe	97
PID 5328 wrote to memory of 4132	5328	CookieSentinel.exe	98
PID 4132 wrote to memory of 4356	4132	CookieSentinel.exe	102
PID 4132 wrote to memory of 3388	4132	CookieSentinel.exe	259
PID 6480 wrote to memory of 4400	6480	1rht1ds2.exe	59
PID 4132 wrote to memory of 2204	4132	CookieSentinel.exe	104
PID 4132 wrote to memory of 4120	4132	CookieSentinel.exe	105
PID 4132 wrote to memory of 1636	4132	CookieSentinel.exe	106
PID 4132 wrote to memory of 4972	4132	CookieSentinel.exe	107
PID 1636 wrote to memory of 4400	1636	1rht1ds2.exe	59
PID 4132 wrote to memory of 4908	4132	CookieSentinel.exe	108
PID 4908 wrote to memory of 3776	4908	CookieSentinel.exe	109
PID 4908 wrote to memory of 3656	4908	CookieSentinel.exe	164
PID 4908 wrote to memory of 3872	4908	CookieSentinel.exe	111
PID 4908 wrote to memory of 3036	4908	CookieSentinel.exe	165
PID 4908 wrote to memory of 1496	4908	CookieSentinel.exe	113
PID 4908 wrote to memory of 7064	4908	CookieSentinel.exe	114
PID 1496 wrote to memory of 4400	1496	1rht1ds2.exe	59
PID 3348 wrote to memory of 6492	3348	2vou07tr.exe	115
PID 6492 wrote to memory of 2240	6492	apza.exe	80
PID 7064 wrote to memory of 6516	7064	2vou07tr.exe	351
PID 4908 wrote to memory of 2760	4908	CookieSentinel.exe	118
PID 2760 wrote to memory of 1348	2760	CookieSentinel.exe	119
PID 2760 wrote to memory of 4128	2760	CookieSentinel.exe	528
PID 2760 wrote to memory of 1376	2760	CookieSentinel.exe	121
PID 2760 wrote to memory of 4332	2760	CookieSentinel.exe	122
PID 2760 wrote to memory of 3344	2760	CookieSentinel.exe	270
PID 3344 wrote to memory of 4400	3344	1rht1ds2.exe	59
PID 2760 wrote to memory of 4572	2760	CookieSentinel.exe	124
PID 4572 wrote to memory of 6232	4572	2vou07tr.exe	425
PID 2760 wrote to memory of 2656	2760	CookieSentinel.exe	127
PID 2656 wrote to memory of 1776	2656	CookieSentinel.exe	128
PID 2656 wrote to memory of 2768	2656	CookieSentinel.exe	129
PID 2656 wrote to memory of 2724	2656	CookieSentinel.exe	130
PID 2656 wrote to memory of 1664	2656	CookieSentinel.exe	131
PID 2656 wrote to memory of 108	2656	CookieSentinel.exe	385
PID 108 wrote to memory of 4400	108	1rht1ds2.exe	59
PID 2656 wrote to memory of 952	2656	CookieSentinel.exe	133
PID 952 wrote to memory of 692	952	CookieSentinel.exe	134
PID 952 wrote to memory of 2632	952	CookieSentinel.exe	707
PID 952 wrote to memory of 7096	952	CookieSentinel.exe	136
PID 952 wrote to memory of 1864	952	CookieSentinel.exe	384
PID 952 wrote to memory of 5128	952	CookieSentinel.exe	635
PID 5128 wrote to memory of 4400	5128	1rht1ds2.exe	59
PID 952 wrote to memory of 2480	952	CookieSentinel.exe	139
PID 952 wrote to memory of 2460	952	CookieSentinel.exe	140
PID 2460 wrote to memory of 2556	2460	CookieSentinel.exe	141
PID 2460 wrote to memory of 2356	2460	CookieSentinel.exe	550
PID 2460 wrote to memory of 3048	2460	CookieSentinel.exe	143
PID 2460 wrote to memory of 5668	2460	CookieSentinel.exe	501
PID 2460 wrote to memory of 2880	2460	CookieSentinel.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2840
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
    "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
      "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4716
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox
        5⤵
        
        PID:4712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox
        5⤵
        
        PID:5824
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\" 2>nul"
        5⤵
        Executes a command shell one-liner
        
        PID:2324
      - C:\Windows\system32\netsh.exe
        
        netsh wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\dia_wifi_tmp\"
        6⤵
        
        PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\9DBCA999CEDB4B81AADF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\9DBCA999CEDB4B81AADF.exe"
        5⤵
        
        PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\FD323FFB41DD464CBF58.exe
        
        "C:\Users\Admin\AppData\Local\Temp\FD323FFB41DD464CBF58.exe"
        5⤵
        
        PID:1344
      - C:\Users\Admin\AppData\Local\Temp\is-GZZP1YDKJR.tmp\FD323FFB41DD464CBF58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-GZZP1YDKJR.tmp\FD323FFB41DD464CBF58.tmp" /SL5="$700C6,2775941,905728,C:\Users\Admin\AppData\Local\Temp\FD323FFB41DD464CBF58.exe"
        6⤵
        
        PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\12E75290F8604D6D98D2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\12E75290F8604D6D98D2.exe"
        5⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\is-GBAPNTUGSK.tmp\12E75290F8604D6D98D2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-GBAPNTUGSK.tmp\12E75290F8604D6D98D2.tmp" /SL5="$500C0,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\12E75290F8604D6D98D2.exe"
        6⤵
        
        PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
      "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
      "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
      4⤵
      Executes dropped EXE
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
      "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1824
  - - C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
      "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
      "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3348
    - - C:\Users\Admin\AppData\Roaming\Vyon\apza.exe
        
        "C:\Users\Admin\AppData\Roaming\Vyon\apza.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
      "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        5⤵
        Executes dropped EXE
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        5⤵
        Executes dropped EXE
        
        PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        5⤵
        Executes dropped EXE
        
        PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        5⤵
        Executes dropped EXE
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        6⤵
        Executes dropped EXE
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        6⤵
        Executes dropped EXE
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        6⤵
        Executes dropped EXE
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        6⤵
        Executes dropped EXE
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:7064
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa71a73bc.bat"
        7⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        7⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        7⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        7⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        7⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6d5f22e5.bat"
        8⤵
        Executes a command shell one-liner
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        8⤵
        Executes dropped EXE
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        8⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        8⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        8⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        9⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        9⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        9⤵
        Executes dropped EXE
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        9⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        9⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpffed8dd4.bat"
        10⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        10⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        10⤵
        Executes dropped EXE
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        10⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        10⤵
        Executes dropped EXE
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        10⤵
        Executes dropped EXE
        
        PID:6036
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp46a1ae79.bat"
        11⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        10⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        11⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        11⤵
        Executes dropped EXE
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        11⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        11⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        11⤵
        Executes dropped EXE
        
        PID:5560
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp75d26b1c.bat"
        12⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        11⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        12⤵
        Executes dropped EXE
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        12⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        12⤵
        Executes dropped EXE
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        12⤵
        Executes dropped EXE
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        12⤵
        Executes dropped EXE
        
        PID:7136
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp29294028.bat"
        13⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        12⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        13⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        13⤵
        Executes dropped EXE
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        13⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        13⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        13⤵
        Executes dropped EXE
        
        PID:1760
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4bb15a2f.bat"
        14⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        13⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        14⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        14⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        14⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        14⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        14⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        14⤵
        
        PID:1884
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp7516de78.bat"
        15⤵
        Executes a command shell one-liner
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        14⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        15⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        15⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        15⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        15⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        15⤵
        Adds Run key to start application
        Suspicious use of SetThreadContext
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        15⤵
        
        PID:2192
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb69f2260.bat"
        16⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        15⤵
        
        PID:256
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        16⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        16⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        16⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        16⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        16⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        16⤵
        
        PID:4636
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfd1d9681.bat"
        17⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        16⤵
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        17⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        17⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        17⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        17⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        17⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        17⤵
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp061d5821.bat"
        18⤵
        Executes a command shell one-liner
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        17⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        18⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        18⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        18⤵
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        18⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        18⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        18⤵
        
        PID:5316
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp473392e5.bat"
        19⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        18⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        19⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        19⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        19⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        19⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        19⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        19⤵
        
        PID:6932
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa6d06be7.bat"
        20⤵
        Executes a command shell one-liner
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        19⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        20⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        20⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        20⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        20⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        20⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        20⤵
        
        PID:4244
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0106ef8a.bat"
        21⤵
        Executes a command shell one-liner
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        20⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        21⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        21⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        21⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        21⤵
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        21⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        21⤵
        
        PID:6352
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcba5504d.bat"
        22⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        21⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        22⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        22⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        22⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        22⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        22⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        22⤵
        
        PID:4652
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp199bcbe5.bat"
        23⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        22⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        23⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        23⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        23⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        23⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        23⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        23⤵
        
        PID:6168
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6cad3bca.bat"
        24⤵
        Executes a command shell one-liner
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        23⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        24⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        24⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        24⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        24⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        24⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        24⤵
        
        PID:6024
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp06f91901.bat"
        25⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        24⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        25⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        25⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        25⤵
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        25⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        25⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        25⤵
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf1924b43.bat"
        26⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        25⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        26⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        26⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        26⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        26⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        26⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        26⤵
        
        PID:5932
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0d1b5343.bat"
        27⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        26⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        27⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        27⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        27⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        27⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        27⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        27⤵
        
        PID:3400
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp340e2b8b.bat"
        28⤵
        Executes a command shell one-liner
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        27⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        28⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        28⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        28⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        28⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        28⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        28⤵
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp98fc7155.bat"
        29⤵
        Executes a command shell one-liner
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        28⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        29⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        29⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        29⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        29⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        29⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        29⤵
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd1ab505f.bat"
        30⤵
        Executes a command shell one-liner
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        29⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        30⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        30⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        30⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        30⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        30⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        30⤵
        
        PID:3508
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2e22dc91.bat"
        31⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        30⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        31⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        31⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        31⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        31⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        31⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        31⤵
        
        PID:2112
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp59de51cb.bat"
        32⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        31⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        32⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        32⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        32⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        32⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        32⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        32⤵
        
        PID:1816
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp495ccfd3.bat"
        33⤵
        Executes a command shell one-liner
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        32⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        33⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        33⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        33⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        33⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        33⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        33⤵
        
        PID:7164
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb3f7b1cb.bat"
        34⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        33⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        34⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        34⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        34⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        34⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        34⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        34⤵
        
        PID:3472
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa407d393.bat"
        35⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        34⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        35⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        35⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        35⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        35⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        35⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        35⤵
        
        PID:5196
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfc8b5ba4.bat"
        36⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        35⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        36⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        36⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        36⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        36⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        36⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        36⤵
        
        PID:1864
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe0ea5df5.bat"
        37⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        36⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        37⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        37⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        37⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        37⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        37⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        37⤵
        
        PID:5896
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp912c3df1.bat"
        38⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        37⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        38⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        38⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        38⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        38⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        38⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        38⤵
        
        PID:2924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc5ad13aa.bat"
        39⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        38⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        39⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        39⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        39⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        39⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        39⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        39⤵
        
        PID:4348
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp37dd941a.bat"
        40⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        39⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        40⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        40⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        40⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        40⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        40⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        40⤵
        
        PID:1404
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp1fea2cd2.bat"
        41⤵
        Executes a command shell one-liner
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        40⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        41⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        41⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        41⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        41⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        41⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        41⤵
        
        PID:5416
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4a0d3070.bat"
        42⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        41⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        42⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        42⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        42⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        42⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        42⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        42⤵
        
        PID:6652
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3744b847.bat"
        43⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        42⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        43⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        43⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        43⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        43⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        43⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        43⤵
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp776d91c9.bat"
        44⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        43⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        44⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        44⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        44⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        44⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        44⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        44⤵
        
        PID:1324
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpb089a30b.bat"
        45⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        44⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        45⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        45⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        45⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        45⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        45⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        45⤵
        
        PID:6280
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp695184d8.bat"
        46⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        45⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        46⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        46⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        46⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        46⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        46⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        46⤵
        
        PID:3248
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5b0e0526.bat"
        47⤵
        
        PID:932
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        46⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        47⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        47⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        47⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        47⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        47⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        47⤵
        
        PID:4984
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp918e3665.bat"
        48⤵
        
        PID:1484
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        47⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        48⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        48⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        48⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        48⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        48⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        48⤵
        
        PID:3816
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp77f894e4.bat"
        49⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        48⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        49⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        49⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        49⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        49⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        49⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        49⤵
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4d2209d8.bat"
        50⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        49⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        50⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        50⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        50⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        50⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        50⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        50⤵
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp734577a5.bat"
        51⤵
        Executes a command shell one-liner
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        50⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        51⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        51⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        51⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        51⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        51⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        51⤵
        
        PID:2828
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0e44d7d7.bat"
        52⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        51⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        52⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        52⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        52⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        52⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        52⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        52⤵
        
        PID:4128
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0a0cd17e.bat"
        53⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        52⤵
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        53⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        53⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        53⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        53⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        53⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        53⤵
        
        PID:5072
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcbc24b30.bat"
        54⤵
        Executes a command shell one-liner
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        53⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        54⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        54⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        54⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        54⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        54⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        54⤵
        
        PID:2420
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp955981c5.bat"
        55⤵
        Executes a command shell one-liner
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        54⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        55⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        55⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        55⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        55⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        55⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        55⤵
        
        PID:7156
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpccdf3e52.bat"
        56⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        55⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        56⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        56⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        56⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        56⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        56⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        56⤵
        
        PID:3176
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp95e7d54c.bat"
        57⤵
        Executes a command shell one-liner
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        56⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        57⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        57⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        57⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        57⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        57⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        57⤵
        
        PID:748
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3f24213f.bat"
        58⤵
        Executes a command shell one-liner
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        57⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        58⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        58⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        58⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        58⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        58⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        58⤵
        
        PID:752
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp50f6f91f.bat"
        59⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        58⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        59⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        59⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        59⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        59⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        59⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        59⤵
        
        PID:6816
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp416b92ff.bat"
        60⤵
        Executes a command shell one-liner
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        59⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        60⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        60⤵
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        60⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        60⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        60⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        60⤵
        
        PID:568
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3d35cfae.bat"
        61⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        60⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        61⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        61⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        61⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        61⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        61⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        61⤵
        
        PID:1328
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp855978d4.bat"
        62⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        61⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        62⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        62⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        62⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        62⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        62⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        62⤵
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp75a6b4d7.bat"
        63⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        62⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        63⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        63⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        63⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        63⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        63⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        63⤵
        
        PID:4776
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp998ebd97.bat"
        64⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        63⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        64⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        64⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        64⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        64⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        64⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        64⤵
        
        PID:4588
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp684b7d1e.bat"
        65⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        64⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        65⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        65⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        65⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        65⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        65⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        65⤵
        
        PID:4388
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp76b8ddce.bat"
        66⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        65⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        66⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        66⤵
        
        PID:2228
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        66⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        66⤵
        
        PID:204
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        66⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        66⤵
        
        PID:4796
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe3dfa8ac.bat"
        67⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        66⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        67⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        67⤵
        
        PID:1184
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        67⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        67⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        67⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        67⤵
        
        PID:2276
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpbc85f09d.bat"
        68⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        67⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        68⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        68⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        68⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        68⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        68⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        68⤵
        
        PID:5800
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp1a1af934.bat"
        69⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        68⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        69⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        69⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        69⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        69⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        69⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        69⤵
        
        PID:2080
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc05d5930.bat"
        70⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        69⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        70⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        70⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        70⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        70⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        70⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        70⤵
        
        PID:6608
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp8a2d2cc3.bat"
        71⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        70⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        71⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        71⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        71⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        71⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        71⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        71⤵
        
        PID:7240
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp4a92b341.bat"
        72⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        71⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        72⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        72⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        72⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        72⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        72⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        72⤵
        
        PID:7708
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc0a6d3a3.bat"
        73⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        72⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        73⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        73⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        73⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        73⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        73⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        73⤵
        
        PID:6152
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5849da39.bat"
        74⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        73⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        74⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        74⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        74⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        74⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        74⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        74⤵
        
        PID:7400
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfcaf948d.bat"
        75⤵
        Executes a command shell one-liner
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        74⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        75⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        75⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        75⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        75⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        75⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        75⤵
        
        PID:7760
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp69a8b685.bat"
        76⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        75⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        76⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        76⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        76⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        76⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        76⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        76⤵
        
        PID:4592
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6b7b7c0a.bat"
        77⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        76⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        77⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        77⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        77⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        77⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        77⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        77⤵
        
        PID:7452
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe4b7362f.bat"
        78⤵
        Executes a command shell one-liner
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        77⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        78⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        78⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        78⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        78⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        78⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        78⤵
        
        PID:7768
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2d381266.bat"
        79⤵
        Executes a command shell one-liner
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        78⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        79⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        79⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        79⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        79⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        79⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        79⤵
        
        PID:3064
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpaea5bc5d.bat"
        80⤵
        Executes a command shell one-liner
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        79⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        80⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        80⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        80⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        80⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        80⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        80⤵
        
        PID:624
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp85c4f19f.bat"
        81⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        80⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        81⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        81⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        81⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        81⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        81⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        81⤵
        
        PID:7988
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp83cea232.bat"
        82⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        81⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        82⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        82⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        82⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        82⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        82⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        82⤵
        
        PID:7960
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9fd14c36.bat"
        83⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        82⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        83⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        83⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        83⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        83⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        83⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        83⤵
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc507ea13.bat"
        84⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        83⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        84⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        84⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        84⤵
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        84⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        84⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        84⤵
        
        PID:7872
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp33c9be66.bat"
        85⤵
        
        PID:7868
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        86⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        84⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        85⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        85⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        85⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        85⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        85⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        85⤵
        
        PID:4564
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd1bd95f4.bat"
        86⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        85⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        86⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        86⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        86⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        86⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        86⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        86⤵
        
        PID:5132
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp36ecddc2.bat"
        87⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        86⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        87⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        87⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        87⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        87⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        87⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        87⤵
        
        PID:7444
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfd4cb695.bat"
        88⤵
        Executes a command shell one-liner
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        87⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        88⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        88⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        88⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        88⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        88⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        88⤵
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2ba9be3d.bat"
        89⤵
        Executes a command shell one-liner
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        88⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        89⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        89⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        89⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        89⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        89⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        89⤵
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0294b165.bat"
        90⤵
        Executes a command shell one-liner
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        89⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        90⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        90⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        90⤵
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        90⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        90⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        90⤵
        
        PID:252
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9b30fb98.bat"
        91⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        90⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        91⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        91⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        91⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        91⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        91⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        91⤵
        
        PID:2792
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpbfdfc38d.bat"
        92⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        91⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        92⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        92⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        92⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        92⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        92⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        92⤵
        
        PID:6672
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp245b2373.bat"
        93⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        92⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        93⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        93⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        93⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        93⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        93⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        93⤵
        
        PID:3560
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6bd57c25.bat"
        94⤵
        Executes a command shell one-liner
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        93⤵
        
        PID:2004
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        94⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        94⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        94⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        94⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        94⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        94⤵
        
        PID:296
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5f47c1ef.bat"
        95⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        94⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        95⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        95⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        95⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        95⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        95⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        95⤵
        
        PID:7124
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa87ddef9.bat"
        96⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        95⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        96⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        96⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        96⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        96⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        96⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        96⤵
        
        PID:2016
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe72fa094.bat"
        97⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        96⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        97⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        97⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        97⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        97⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        97⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        97⤵
        
        PID:8152
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfa1d9cc7.bat"
        98⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        97⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        98⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        98⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        98⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        98⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        98⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        98⤵
        
        PID:5956
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpec6c65e2.bat"
        99⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        98⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        99⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        99⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        99⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        99⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        99⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        99⤵
        
        PID:7296
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp317da14e.bat"
        100⤵
        Executes a command shell one-liner
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        99⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        100⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        100⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        100⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        100⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        100⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        100⤵
        
        PID:3388
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3424eb44.bat"
        101⤵
        Executes a command shell one-liner
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        100⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        101⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        101⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        101⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        101⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        101⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        101⤵
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3082afe3.bat"
        102⤵
        Executes a command shell one-liner
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        101⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        102⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        102⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        102⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        102⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        102⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        102⤵
        
        PID:7996
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp0e84c7f0.bat"
        103⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        102⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        103⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        103⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        103⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        103⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        103⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        103⤵
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp62fda37c.bat"
        104⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        103⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        104⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        104⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        104⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        104⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        104⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        104⤵
        
        PID:4932
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa438f9a4.bat"
        105⤵
        Executes a command shell one-liner
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        104⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        105⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        105⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        105⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        105⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        105⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        105⤵
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfe442a16.bat"
        106⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        105⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        106⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        106⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        106⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        106⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        106⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        106⤵
        
        PID:5740
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp6afe233e.bat"
        107⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        106⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        107⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        107⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        107⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        107⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        107⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        107⤵
        
        PID:8012
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd11360c8.bat"
        108⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        107⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        108⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        108⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        108⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        108⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        108⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        108⤵
        
        PID:5768
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5fdb42b4.bat"
        109⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        108⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        109⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        109⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        109⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        109⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        109⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        109⤵
        
        PID:1940
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp89063a59.bat"
        110⤵
        Executes a command shell one-liner
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        109⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        110⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        110⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        110⤵
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        110⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        110⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        110⤵
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2f98291c.bat"
        111⤵
        Executes a command shell one-liner
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        110⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        111⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        111⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        111⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        111⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        111⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        111⤵
        
        PID:2628
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp27aace0c.bat"
        112⤵
        Executes a command shell one-liner
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        111⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        112⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        112⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        112⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        112⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        112⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        112⤵
        
        PID:6528
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpab188fe6.bat"
        113⤵
        Executes a command shell one-liner
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        112⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        113⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        113⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        113⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        113⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        113⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        113⤵
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd93977de.bat"
        114⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        113⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        114⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        114⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        114⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        114⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        114⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        114⤵
        
        PID:7756
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp3d5b10b0.bat"
        115⤵
        Executes a command shell one-liner
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        114⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        115⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        115⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        115⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        115⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        115⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        115⤵
        
        PID:1524
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp7b30eccb.bat"
        116⤵
        Executes a command shell one-liner
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        115⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        116⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        116⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        116⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        116⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        116⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        116⤵
        
        PID:7992
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpc1e7b084.bat"
        117⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        116⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        117⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        117⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        117⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        117⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        117⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        117⤵
        
        PID:3924
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfaae546c.bat"
        118⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        117⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        118⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        118⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        118⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        118⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        118⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        118⤵
        
        PID:2648
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpe86ade2f.bat"
        119⤵
        Executes a command shell one-liner
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        118⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        119⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        119⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        119⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        119⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        119⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        119⤵
        
        PID:7332
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp853eba62.bat"
        120⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        119⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        120⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        120⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        120⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        120⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        120⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        120⤵
        
        PID:7368
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp332e66cb.bat"
        121⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        120⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        121⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        121⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        121⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        121⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        121⤵
        
        PID:1060
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        121⤵
        
        PID:6040
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp74b980fd.bat"
        122⤵
        Executes a command shell one-liner
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        121⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        122⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        122⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        122⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        122⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        122⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        122⤵
        
        PID:7172
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpafe29390.bat"
        123⤵
        Executes a command shell one-liner
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        122⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        123⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        123⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        123⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        123⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        123⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        123⤵
        
        PID:8028
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp78a5368a.bat"
        124⤵
        Executes a command shell one-liner
        
        PID:7844
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        125⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        123⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        124⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        124⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        124⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        124⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        124⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        124⤵
        
        PID:1184
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp70953b8f.bat"
        125⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        124⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        125⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        125⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        125⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        125⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        125⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        125⤵
        
        PID:5704
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp523b10e2.bat"
        126⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        125⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        126⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        126⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        126⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        126⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        126⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        126⤵
        
        PID:6536
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpccd726fd.bat"
        127⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        126⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        127⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        127⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        127⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        127⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        127⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        127⤵
        
        PID:7380
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpcffcf060.bat"
        128⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        127⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        128⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe"
        128⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe"
        128⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe"
        128⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe"
        128⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe"
        128⤵
        
        PID:1032
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpbc0cb9ab.bat"
        129⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe
        
        "C:\Users\Admin\AppData\Local\Temp\CookieSentinel.exe"
        128⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe"
        129⤵
        
        PID:2448

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Users\Admin\AppData\Roaming\msedgeupdatecdl.exe
C:\Users\Admin\AppData\Roaming\msedgeupdatecdl.exe
1⤵
- Executes dropped EXE
PID:5664

C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6480

C:\Users\Admin\AppData\Roaming\Vyon\apza.exe
C:\Users\Admin\AppData\Roaming\Vyon\apza.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\9DBCA999CEDB4B81AADF.exe
C:\Users\Admin\AppData\Local\Temp\9DBCA999CEDB4B81AADF.exe
1⤵
PID:6404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1rht1ds2.exe

Path C:\Users\Admin\AppData\Local\Temp\1rht1ds2.exe
Size 1.1MB
SHA256 4acd7adff5c2193e7b0b9a6f8235534d67772ff3d7fa59b1215de011d7455ad9
MD5 5397d935f89da936fe739139a99c7b47
SHA1 27adcb8fc4c6685c35819569895a8afac75f1b1d
SHA512 32fcb9db51cb8ff24f47897535dea5ca671e79ed207e9f3083e83034ad523e8a628831f9ebc0b61aa5f3025b3a395e887c24f257918ef2a86913f1a7c6ec158f
SSDEEP 12288:RPhnbZIqgm1W6GTt/nUWxwsLkzEc3lktyamaghtXhDmZA83bTe6rbBpcYm:DnbZVs6G3NLkzEGlu6zWrTeobBpc
TLSH
T184359E2AFED25111DD7ED3B3BD30FE189646200583522E7A279F4EC46813C96ADA335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2vou07tr.exe

Path C:\Users\Admin\AppData\Local\Temp\2vou07tr.exe
Size 216KB
SHA256 f5552210d30af1847134a532d8046b1d979b16cafaa2afe4b898feb453b753d4
MD5 2078a0901a9237757094fe3597c184ec
SHA1 308a2ea223ccf2d50b827ed2dc2b293abfa12d52
SHA512 af27f2442fdbbc17c6985b437979820d4ecf109830b4ae043b8127d9d0e79703eb757bb84728ad5709c911360efa18983c45104a8226d5761a1124745c80c930
SSDEEP 3072:2Au/wJ+GbVssPjKuBUm9qUPKZADspagfZ+ix1FdxETc5ZHxj3pX:2A4wJxbVssP2uBJ93PKZnrnxEsZ/X
TLSH
T176249E1AB5E45BB8F9AFD135C5857A26C1B2744A5B30D38F22B4CE962F13332E12D342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fqxo4qtq.exe

Path C:\Users\Admin\AppData\Local\Temp\fqxo4qtq.exe
Size 166KB
SHA256 fcbe9f2d0f07f6c40b258228148fb61e94f4dc59962f2fd4e3ed3051d90cfa3b
MD5 b61499aed9660923cde55a2cd3c88cc5
SHA1 8b1260a28e06c9c0c2d5ae48195aab24926901d3
SHA512 ee96b28539d8a6f75a0e3678420f8e764f26ec36a91c07e1b66421bbd2d723ed818a3ed7dd756a0d70aaac8a1c73960f67f1888ca9cfd99750a465af1ba8461d
SSDEEP 3072:btJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvOvHXrbl5STd:bwCszCYJ8OcgsaftB
TLSH
T1FDF37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fr8juhy7.exe

Path C:\Users\Admin\AppData\Local\Temp\fr8juhy7.exe
Size 54KB
SHA256 985ead812b8b99573d2567169d73968a3754b4fbea16447bea2ac878974e6110
MD5 26b59bc7336133a5e2f3c696584a9cb9
SHA1 bc2f26426ab52186449688d6e56326a4ef65de27
SHA512 6292a2c4e44449cd7f02aebb2b3f3f6c6b9425c851b75946575004a84b075ab9a26dd2cd705b5dbd41d9eaf672217ed7c0e611b6c99bd0190e3a001986085b36
SSDEEP 1536:KP2AunwYLdkqx4sOLsWz129UXMRRpUafq8LECJu:znXfqLsWJ2LRJfq8Lbu
TLSH
T1ED43082653A213B9D9EAC636C9F4533BF1F07542BA26931F0378F6281B73742751CAA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g7x3qys3.exe

Path C:\Users\Admin\AppData\Local\Temp\g7x3qys3.exe
Size 2.3MB
SHA256 ea449d04d3a664eadbff4e054b1717ce36db82c40d27f179833cf15118de9e73
MD5 158a748771be8a06b496a410516d63a9
SHA1 a5926b439887f3f8d4f6b2686c5d4081673ff862
SHA512 491f1f18dc0f03261b5984255036e37c930cf368d7c11df4aead335a2feb8dcae366b575d4d2f3114d53e396568bdd1b940a20749ff562614dfb746d261b46bc
SSDEEP 49152:Lp2n/GN8i6JmPXcjxR2Z3Au/PJvTs6EBC:xCxRa/54
TLSH
T1FAB59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iteuqc1j.exe

Path C:\Users\Admin\AppData\Local\Temp\iteuqc1j.exe
Size 2.3MB
SHA256 f36e78186fbd277bf7fde60d795dee4ec10531ae28ce63f46312a2a20d9da901
MD5 c509dc68dee52fa310a763a3e2510643
SHA1 0c8dab58bb0fb421089c06ceed5df21ec35ffbff
SHA512 5eb12373223e3fec7d74ad2ed57b99d3a8eedef6eff8a6654d6ca20357c1960c78d762664620d0170a1b6fea4962668cf942ae114ef4cb9f1d8f83e21a282347
SSDEEP 49152:4e2n/GN8i6JmPXcjgR2Z3Au/PJvTs6xBC:nCgRa/54
TLSH
T177B59E4AA3A802FDE0FBD274C9165A07D7B2B8461674D79F13D0479A2F23B715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp46a1ae79.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp46a1ae79.bat
Size 195B
SHA256 0b0c1ca61781111f12794d5c72659e45f02db92dd9fc1834bc7bd7d3b789e6a5
MD5 a15e97ca67ac050680de40caaa35f1c1
SHA1 683f72a5a81454616e7d1441ac5bfe3f0a8bf2cb
SHA512 62f24316674a1422ab9a336d43032075ba89831b5dc2105e8ef410f9d2fb765e4a9b56d7b051df39b2c45382611092e78dd7293dc1260e099b9768eebf11ac31
TLSH
T1E3D0121186CAC69E2C0C616786F565CCD0690CD83F8F67509621C54D619281DF5D7751
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6d5f22e5.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6d5f22e5.bat
Size 195B
SHA256 b3dfc74079d6d48571c7c81da8bc01e9c197cc1914bdd1c8cd827abb40c6e212
MD5 b3a2fcb21718785560a2849bbc574d1e
SHA1 9527d83b211c35e8c2a33454a87c689ecce02f1f
SHA512 ccd1e1b911c1f2976125bcdfd8a727b95f3c29b9cf4639e56423c191fbdc6e88c8884985e573d18d7ab99b36b8ff5bac39f9b56172f5554476972b2617173324
TLSH
T133D0121142CAC6DE1C0C616B86F561CCD0690C9C3F8EA7509621C55E61E241DF6C7751
MD5 SHA1 SHA512 TLSH

Submit Download

tmpa71a73bc.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpa71a73bc.bat
Size 195B
SHA256 c04ff0903d2eaa1e8644d42091d62576ac34adc3ab9748503492d57d468e6b3c
MD5 d4816e965a8a6d9888482478128ff414
SHA1 99f79c63d39f0ef6da288e0d742cbc5fc8299a2e
SHA512 d67ccda52d32e689f849b0ff0e4dd8952d33ce8db90fe5513da2e2a29d393db32fe62841d883354c76c500d3389aaf1aeb03fb414917d28973f2671d2160f66e
TLSH
T164D0122142CAC7DE1C0D616B4AF561CCD0B94DE83F8E67609621C54DA19281DF5CBB51
MD5 SHA1 SHA512 TLSH

Submit Download

tmpffed8dd4.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpffed8dd4.bat
Size 195B
SHA256 5eeb0b78305ab9f75946539b1803f14c7ff529ed66dc82f6e5ea6c40f2bab461
MD5 4167cdeaa391cf647c8f04693076e81d
SHA1 19ee1987e06a59aa1f891b91e0b592588ab8d645
SHA512 a9bc26dde1ee5653dee576945d3beac5f8e9d7ddeb478b9fea7a483ea14ec689679928a7a2d94c51f9a978e805900d3f5a8f529b983ba9153ec0f1a6872e264a
TLSH
T110D0121142CAC69E1C4C61674AFA61CDD0F91CD83F8EB7509621C64D629241DF9C7741
MD5 SHA1 SHA512 TLSH

Submit Download

apza.exe

Path C:\Users\Admin\AppData\Roaming\Vyon\apza.exe
Size 216KB
SHA256 4cc33ac0f725c73decb2956b03d03c01bfdedcbacecabda21b003cf9be723c15
MD5 80d1c60f042204d8d490eb2555dfba78
SHA1 6ec7f6341329d4317083f3a47a2c71e2b5dc3806
SHA512 3b06e0798b43bd22cdba7c8a9a803cf5342379e15d89a134313aeef1ff38d6b4f56fbaf23fcc2fafb749c1c212630d8581e32424043f364454c5a390c9ddfd91
SSDEEP 3072:2Au/wJ+GbVssPjKuBUm9qUPKZADspagfZ+ix1FdxETc5ZHxj3pURp:2A4wJxbVssP2uBJ93PKZnrnxEsZ/URp
TLSH
T1CB249E1AB5E45BB8F9AFD135C5857A26C1B2744A5B31D3CF22B4CE962F13332A12D342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2240-57-0x00000000037F0000-0x00000000037F1000-memory.dmp

Download

memory/2240-58-0x0000000003800000-0x0000000003801000-memory.dmp

Download

memory/2240-106-0x0000000003AF0000-0x0000000003B32000-memory.dmp

Download

memory/2240-105-0x0000000003AF0000-0x0000000003B32000-memory.dmp

Download

memory/2240-104-0x0000000003AF0000-0x0000000003B32000-memory.dmp

Download

memory/2240-103-0x0000000003AF0000-0x0000000003B32000-memory.dmp

Download

memory/2240-59-0x0000000003810000-0x0000000003811000-memory.dmp

Download

memory/2240-21-0x0000000180000000-0x0000000180005000-memory.dmp

Download

memory/3348-151-0x0000000001E50000-0x0000000001EF9000-memory.dmp

Download

memory/3348-144-0x0000000001DB0000-0x0000000001DBB000-memory.dmp

Download

memory/3348-109-0x00000000005C0000-0x0000000000687000-memory.dmp

Download

memory/3348-149-0x0000000001DF0000-0x0000000001E1A000-memory.dmp

Download

memory/3348-146-0x0000000001DC0000-0x0000000001DE7000-memory.dmp

Download

memory/3348-130-0x0000000000EB0000-0x0000000000EB8000-memory.dmp

Download

memory/3348-119-0x0000000000EF0000-0x0000000000FA2000-memory.dmp

Download

memory/3348-153-0x0000000001F00000-0x0000000001FA7000-memory.dmp

Download

memory/3348-118-0x0000000000CE0000-0x0000000000EA3000-memory.dmp

Download

memory/3348-116-0x0000000000B40000-0x0000000000BDD000-memory.dmp

Download

memory/3348-111-0x0000000000690000-0x0000000000A31000-memory.dmp

Download

memory/3348-135-0x0000000001920000-0x0000000001994000-memory.dmp

Download

memory/3348-123-0x0000000000FB0000-0x000000000100D000-memory.dmp

Download

memory/3348-142-0x00000000018F0000-0x000000000190A000-memory.dmp

Download

memory/3348-139-0x00000000018E0000-0x00000000018ED000-memory.dmp

Download

memory/4400-60-0x000002B135F30000-0x000002B135F62000-memory.dmp

Download

memory/4400-17-0x000002B134AB0000-0x000002B134AB2000-memory.dmp

Download

memory/4972-145-0x0000000001D10000-0x0000000001D1B000-memory.dmp

Download

memory/4972-147-0x0000000001D20000-0x0000000001D47000-memory.dmp

Download

memory/4972-143-0x0000000001850000-0x000000000186A000-memory.dmp

Download

memory/4972-112-0x00000000006A0000-0x0000000000A41000-memory.dmp

Download

memory/4972-132-0x0000000000E00000-0x0000000000E08000-memory.dmp

Download

memory/4972-120-0x0000000000E50000-0x0000000000F02000-memory.dmp

Download

memory/4972-138-0x0000000001840000-0x000000000184D000-memory.dmp

Download

memory/4972-154-0x0000000001F10000-0x0000000002026000-memory.dmp

Download

memory/4972-115-0x0000000000C30000-0x0000000000DF3000-memory.dmp

Download

memory/4972-148-0x0000000001D50000-0x0000000001D7A000-memory.dmp

Download

memory/4972-122-0x0000000000F10000-0x0000000000F6D000-memory.dmp

Download

memory/4972-150-0x0000000001DB0000-0x0000000001E59000-memory.dmp

Download

memory/4972-110-0x00000000005D0000-0x0000000000697000-memory.dmp

Download

memory/4972-152-0x0000000001E60000-0x0000000001F07000-memory.dmp

Download

memory/7064-171-0x0000000001E60000-0x0000000001F07000-memory.dmp

Download

memory/7064-164-0x0000000001840000-0x000000000184D000-memory.dmp

Download

memory/7064-126-0x0000000000F70000-0x0000000001666000-memory.dmp

Download

memory/7064-167-0x0000000001D10000-0x0000000001D1B000-memory.dmp

Download

memory/7064-168-0x0000000001D20000-0x0000000001D47000-memory.dmp

Download

memory/7064-169-0x0000000001D50000-0x0000000001D7A000-memory.dmp

Download

memory/7064-170-0x0000000001DB0000-0x0000000001E59000-memory.dmp

Download

memory/7064-176-0x00000000025B0000-0x00000000025F8000-memory.dmp

Download

memory/7064-178-0x0000000002730000-0x000000000274B000-memory.dmp

Download

memory/7064-179-0x0000000002750000-0x000000000275D000-memory.dmp

Download

memory/7064-180-0x0000000002970000-0x000000000299F000-memory.dmp

Download

memory/7064-181-0x0000000003FB0000-0x0000000003FCC000-memory.dmp

Download

memory/7064-182-0x0000000004090000-0x00000000040C8000-memory.dmp

Download

memory/7064-183-0x00000000040D0000-0x00000000040DC000-memory.dmp

Download

memory/7064-184-0x00000000040E0000-0x0000000004179000-memory.dmp

Download

memory/7064-113-0x0000000000620000-0x00000000006E7000-memory.dmp

Download

memory/7064-185-0x0000000004570000-0x0000000004596000-memory.dmp

Download

memory/7064-114-0x00000000006F0000-0x0000000000A91000-memory.dmp

Download

memory/7064-121-0x0000000000E50000-0x0000000000F02000-memory.dmp

Download

memory/7064-124-0x0000000000F10000-0x0000000000F6D000-memory.dmp

Download

memory/7064-117-0x0000000000C80000-0x0000000000E43000-memory.dmp

Download

memory/7064-173-0x0000000002030000-0x00000000020D3000-memory.dmp

Download

memory/7064-166-0x0000000001850000-0x000000000186A000-memory.dmp

Download

memory/7064-162-0x0000000001880000-0x00000000018F4000-memory.dmp

Download

memory/7064-128-0x00000000004D0000-0x00000000004D8000-memory.dmp

Download