Overview

overview

7

Static

static

3

2026-09-08...om.exe

windows10-2004-x64

7

2026-09-08...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    29s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_cbd7969bf7c80b574990c5bd16025442_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 5.4MB
  • Sample260910-c63mtadl7v
  • SHA256 454e1c87dfcb1f7ae9925cb755b44cc7c0486ef1b24e9e409bfba2a0ec91dc47
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationpyinstaller

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 42 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 21 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs
    defense_evasion
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_cbd7969bf7c80b574990c5bd16025442_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_cbd7969bf7c80b574990c5bd16025442_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_cbd7969bf7c80b574990c5bd16025442_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_cbd7969bf7c80b574990c5bd16025442_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe"
          4⤵
            PID:1212
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zdqmitgf\vjltyamf.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1984
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zdqmitgf\vjltyamf.exe"
            4⤵
            • Views/modifies file attributes
            PID:2056
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zdqmitgf\vjltyamf.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zdqmitgf\vjltyamf.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3272
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zdqmitgf\vjltyamf.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zdqmitgf\vjltyamf.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1724
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il1wn9r8\yezi7vkb.exe"
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:4520
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il1wn9r8\yezi7vkb.exe"
            4⤵
            • Views/modifies file attributes
            PID:3184
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il1wn9r8\yezi7vkb.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il1wn9r8\yezi7vkb.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il1wn9r8\yezi7vkb.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\il1wn9r8\yezi7vkb.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8t8ypbc\q20x253b.exe"
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:2980
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8t8ypbc\q20x253b.exe"
            4⤵
            • Views/modifies file attributes
            PID:4288
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8t8ypbc\q20x253b.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8t8ypbc\q20x253b.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8t8ypbc\q20x253b.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v8t8ypbc\q20x253b.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8boprj1\d1pf5rkr.exe"
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:4872
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8boprj1\d1pf5rkr.exe"
            4⤵
            • Views/modifies file attributes
            PID:4444
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8boprj1\d1pf5rkr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8boprj1\d1pf5rkr.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8boprj1\d1pf5rkr.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x8boprj1\d1pf5rkr.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j4krhejn\9s1h7iss.exe"
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:1600
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j4krhejn\9s1h7iss.exe"
            4⤵
            • Views/modifies file attributes
            PID:5008
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j4krhejn\9s1h7iss.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j4krhejn\9s1h7iss.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j4krhejn\9s1h7iss.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j4krhejn\9s1h7iss.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3848
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax8rqgna\4g4p9q68.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:380
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax8rqgna\4g4p9q68.exe"
            4⤵
              PID:3676
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax8rqgna\4g4p9q68.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax8rqgna\4g4p9q68.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax8rqgna\4g4p9q68.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ax8rqgna\4g4p9q68.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q60vbp8y\25bmectn.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2124
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q60vbp8y\25bmectn.exe"
              4⤵
                PID:3512
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q60vbp8y\25bmectn.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q60vbp8y\25bmectn.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4732
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q60vbp8y\25bmectn.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\q60vbp8y\25bmectn.exe
            2⤵
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fwnuhk13\tegffgem.exe"
              3⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:4184
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fwnuhk13\tegffgem.exe"
                4⤵
                • Views/modifies file attributes
                PID:3028
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fwnuhk13\tegffgem.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fwnuhk13\tegffgem.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3580
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fwnuhk13\tegffgem.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fwnuhk13\tegffgem.exe
            2⤵
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2996
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmooawv3\oukfmla9.exe"
              3⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:540
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmooawv3\oukfmla9.exe"
                4⤵
                  PID:3512
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmooawv3\oukfmla9.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmooawv3\oukfmla9.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4380
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmooawv3\oukfmla9.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nmooawv3\oukfmla9.exe
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1060
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mlxkux6\ytqtct0l.exe"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2056
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mlxkux6\ytqtct0l.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:4992
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mlxkux6\ytqtct0l.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mlxkux6\ytqtct0l.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1028
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mlxkux6\ytqtct0l.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mlxkux6\ytqtct0l.exe
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:4752
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wmgtiuif\wq6hgy9h.exe"
                3⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:3412
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wmgtiuif\wq6hgy9h.exe"
                  4⤵
                    PID:4532
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wmgtiuif\wq6hgy9h.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wmgtiuif\wq6hgy9h.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3500
              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wmgtiuif\wq6hgy9h.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wmgtiuif\wq6hgy9h.exe
                2⤵
                • Creates a file in the Startup directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:1244
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbbpr7ej\b117nwiq.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:964
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbbpr7ej\b117nwiq.exe"
                    4⤵
                    • Views/modifies file attributes
                    PID:1612
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbbpr7ej\b117nwiq.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbbpr7ej\b117nwiq.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:2720
              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbbpr7ej\b117nwiq.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zbbpr7ej\b117nwiq.exe
                2⤵
                • Creates a file in the Startup directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:4320
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qj7vt61c\wkticwdk.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5128
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qj7vt61c\wkticwdk.exe"
                    4⤵
                      PID:5200
              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qj7vt61c\wkticwdk.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qj7vt61c\wkticwdk.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5288
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qj7vt61c\wkticwdk.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qj7vt61c\wkticwdk.exe
                  2⤵
                  • Creates a file in the Startup directory
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of WriteProcessMemory
                  PID:5360
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y29pygd9\juygvaur.exe"
                    3⤵
                    • Hide Artifacts: Hidden Files and Directories
                    • Suspicious use of WriteProcessMemory
                    PID:5392
                    • C:\Windows\system32\attrib.exe
                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y29pygd9\juygvaur.exe"
                      4⤵
                        PID:5448
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y29pygd9\juygvaur.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y29pygd9\juygvaur.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5540
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y29pygd9\juygvaur.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y29pygd9\juygvaur.exe
                    2⤵
                    • Creates a file in the Startup directory
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:5616
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgy7dbbm\a15m8iio.exe"
                      3⤵
                      • Hide Artifacts: Hidden Files and Directories
                      • Suspicious use of WriteProcessMemory
                      PID:5656
                      • C:\Windows\system32\attrib.exe
                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgy7dbbm\a15m8iio.exe"
                        4⤵
                        • Views/modifies file attributes
                        PID:5712
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgy7dbbm\a15m8iio.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgy7dbbm\a15m8iio.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5856
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgy7dbbm\a15m8iio.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgy7dbbm\a15m8iio.exe
                    2⤵
                    • Creates a file in the Startup directory
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:5932
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\quxz2wor\eqhnaiaz.exe"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5972
                      • C:\Windows\system32\attrib.exe
                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\quxz2wor\eqhnaiaz.exe"
                        4⤵
                        • Views/modifies file attributes
                        PID:6020
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\quxz2wor\eqhnaiaz.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\quxz2wor\eqhnaiaz.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:6124
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\quxz2wor\eqhnaiaz.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\quxz2wor\eqhnaiaz.exe
                    2⤵
                    • Creates a file in the Startup directory
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:5192
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lwyo8zho\kpkd1ena.exe"
                      3⤵
                      • Hide Artifacts: Hidden Files and Directories
                      • Suspicious use of WriteProcessMemory
                      PID:5220
                      • C:\Windows\system32\attrib.exe
                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lwyo8zho\kpkd1ena.exe"
                        4⤵
                          PID:5504
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lwyo8zho\kpkd1ena.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lwyo8zho\kpkd1ena.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5676
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lwyo8zho\kpkd1ena.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lwyo8zho\kpkd1ena.exe
                      2⤵
                      • Creates a file in the Startup directory
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:5872
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8pha970\3i5mc5zx.exe"
                        3⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:5904
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8pha970\3i5mc5zx.exe"
                          4⤵
                          • Views/modifies file attributes
                          PID:5984
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8pha970\3i5mc5zx.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8pha970\3i5mc5zx.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5204
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8pha970\3i5mc5zx.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\t8pha970\3i5mc5zx.exe
                      2⤵
                      • Creates a file in the Startup directory
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:5568
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hy25nby\u84cupvb.exe"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5224
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hy25nby\u84cupvb.exe"
                          4⤵
                          • Views/modifies file attributes
                          PID:5740
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hy25nby\u84cupvb.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hy25nby\u84cupvb.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5964
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hy25nby\u84cupvb.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5hy25nby\u84cupvb.exe
                      2⤵
                      • Creates a file in the Startup directory
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of WriteProcessMemory
                      PID:5564
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5vww8kj0\6fk70f1t.exe"
                        3⤵
                        • Hide Artifacts: Hidden Files and Directories
                        • Suspicious use of WriteProcessMemory
                        PID:5836
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5vww8kj0\6fk70f1t.exe"
                          4⤵
                          • Views/modifies file attributes
                          PID:5840
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5vww8kj0\6fk70f1t.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5vww8kj0\6fk70f1t.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5852
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5vww8kj0\6fk70f1t.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5vww8kj0\6fk70f1t.exe
                      2⤵
                      • Executes dropped EXE
                      PID:5708
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaz1tadk\gybuxi6h.exe"
                        3⤵
                        • Hide Artifacts: Hidden Files and Directories
                        PID:5572
                        • C:\Windows\system32\attrib.exe
                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaz1tadk\gybuxi6h.exe"
                          4⤵
                          • Views/modifies file attributes
                          PID:6196
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaz1tadk\gybuxi6h.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaz1tadk\gybuxi6h.exe
                    1⤵
                      PID:6420
                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaz1tadk\gybuxi6h.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jaz1tadk\gybuxi6h.exe
                        2⤵
                          PID:6496
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ehq0thsj\b3te48pd.exe"
                            3⤵
                            • Hide Artifacts: Hidden Files and Directories
                            PID:6524
                            • C:\Windows\system32\attrib.exe
                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ehq0thsj\b3te48pd.exe"
                              4⤵
                                PID:6632
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ehq0thsj\b3te48pd.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ehq0thsj\b3te48pd.exe
                          1⤵
                            PID:6724
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ehq0thsj\b3te48pd.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ehq0thsj\b3te48pd.exe
                              2⤵
                                PID:6796
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aj7pggj3\i749yeoh.exe"
                                  3⤵
                                  • Hide Artifacts: Hidden Files and Directories
                                  PID:6840
                                  • C:\Windows\system32\attrib.exe
                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aj7pggj3\i749yeoh.exe"
                                    4⤵
                                      PID:6896
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aj7pggj3\i749yeoh.exe
                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aj7pggj3\i749yeoh.exe
                                1⤵
                                  PID:7004
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aj7pggj3\i749yeoh.exe
                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\aj7pggj3\i749yeoh.exe
                                    2⤵
                                      PID:7084
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qgef64m0\ex83u479.exe"
                                        3⤵
                                        • Hide Artifacts: Hidden Files and Directories
                                        PID:7112
                                        • C:\Windows\system32\attrib.exe
                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qgef64m0\ex83u479.exe"
                                          4⤵
                                          • Views/modifies file attributes
                                          PID:5556
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qgef64m0\ex83u479.exe
                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qgef64m0\ex83u479.exe
                                    1⤵
                                      PID:6044
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qgef64m0\ex83u479.exe
                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qgef64m0\ex83u479.exe
                                        2⤵
                                          PID:6384
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5sv22kva\i4jhc07v.exe"
                                            3⤵
                                            • Hide Artifacts: Hidden Files and Directories
                                            PID:6464
                                            • C:\Windows\system32\attrib.exe
                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5sv22kva\i4jhc07v.exe"
                                              4⤵
                                              • Views/modifies file attributes
                                              PID:6644
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5sv22kva\i4jhc07v.exe
                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5sv22kva\i4jhc07v.exe
                                        1⤵
                                          PID:6836
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5sv22kva\i4jhc07v.exe
                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5sv22kva\i4jhc07v.exe
                                            2⤵
                                              PID:6952
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hioytcyy\1g7exqza.exe"
                                                3⤵
                                                • Hide Artifacts: Hidden Files and Directories
                                                PID:7040
                                                • C:\Windows\system32\attrib.exe
                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hioytcyy\1g7exqza.exe"
                                                  4⤵
                                                  • Views/modifies file attributes
                                                  PID:7108
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hioytcyy\1g7exqza.exe
                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hioytcyy\1g7exqza.exe
                                            1⤵
                                              PID:3968
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hioytcyy\1g7exqza.exe
                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hioytcyy\1g7exqza.exe
                                                2⤵
                                                  PID:4772
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nol68l5x\hodmkdj3.exe"
                                                    3⤵
                                                    • Hide Artifacts: Hidden Files and Directories
                                                    PID:5328
                                                    • C:\Windows\system32\attrib.exe
                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nol68l5x\hodmkdj3.exe"
                                                      4⤵
                                                      • Views/modifies file attributes
                                                      PID:6460
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nol68l5x\hodmkdj3.exe
                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nol68l5x\hodmkdj3.exe
                                                1⤵
                                                  PID:6892
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nol68l5x\hodmkdj3.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nol68l5x\hodmkdj3.exe
                                                    2⤵
                                                      PID:7032
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6dg8l16r\dddwnz0c.exe"
                                                        3⤵
                                                        • Hide Artifacts: Hidden Files and Directories
                                                        PID:5832
                                                        • C:\Windows\system32\attrib.exe
                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6dg8l16r\dddwnz0c.exe"
                                                          4⤵
                                                          • Views/modifies file attributes
                                                          PID:7116
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6dg8l16r\dddwnz0c.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6dg8l16r\dddwnz0c.exe
                                                    1⤵
                                                      PID:6456
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6dg8l16r\dddwnz0c.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6dg8l16r\dddwnz0c.exe
                                                        2⤵
                                                          PID:6888
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs1yotry\vcwzra0q.exe"
                                                            3⤵
                                                            • Hide Artifacts: Hidden Files and Directories
                                                            PID:6516
                                                            • C:\Windows\system32\attrib.exe
                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs1yotry\vcwzra0q.exe"
                                                              4⤵
                                                              • Views/modifies file attributes
                                                              PID:6204
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs1yotry\vcwzra0q.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs1yotry\vcwzra0q.exe
                                                        1⤵
                                                          PID:6784
                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs1yotry\vcwzra0q.exe
                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qs1yotry\vcwzra0q.exe
                                                            2⤵
                                                              PID:6512
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xlvy6poh\kyzko30g.exe"
                                                                3⤵
                                                                  PID:7140
                                                                  • C:\Windows\system32\attrib.exe
                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xlvy6poh\kyzko30g.exe"
                                                                    4⤵
                                                                      PID:5112
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xlvy6poh\kyzko30g.exe
                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xlvy6poh\kyzko30g.exe
                                                                1⤵
                                                                  PID:6292
                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xlvy6poh\kyzko30g.exe
                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xlvy6poh\kyzko30g.exe
                                                                    2⤵
                                                                      PID:7244
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9wx81glp\zdncrclh.exe"
                                                                        3⤵
                                                                          PID:7284
                                                                          • C:\Windows\system32\attrib.exe
                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9wx81glp\zdncrclh.exe"
                                                                            4⤵
                                                                            • Views/modifies file attributes
                                                                            PID:7340
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9wx81glp\zdncrclh.exe
                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9wx81glp\zdncrclh.exe
                                                                      1⤵
                                                                        PID:7488
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9wx81glp\zdncrclh.exe
                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9wx81glp\zdncrclh.exe
                                                                          2⤵
                                                                            PID:7560
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b31cvrdl\h1u8fubq.exe"
                                                                              3⤵
                                                                                PID:7596
                                                                                • C:\Windows\system32\attrib.exe
                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b31cvrdl\h1u8fubq.exe"
                                                                                  4⤵
                                                                                  • Views/modifies file attributes
                                                                                  PID:7664
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b31cvrdl\h1u8fubq.exe
                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b31cvrdl\h1u8fubq.exe
                                                                            1⤵
                                                                              PID:7800
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b31cvrdl\h1u8fubq.exe
                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b31cvrdl\h1u8fubq.exe
                                                                                2⤵
                                                                                  PID:7876
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2u67lozl\oqe863bd.exe"
                                                                                    3⤵
                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                    PID:7908
                                                                                    • C:\Windows\system32\attrib.exe
                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2u67lozl\oqe863bd.exe"
                                                                                      4⤵
                                                                                      • Views/modifies file attributes
                                                                                      PID:7964
                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2u67lozl\oqe863bd.exe
                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2u67lozl\oqe863bd.exe
                                                                                1⤵
                                                                                  PID:8096
                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2u67lozl\oqe863bd.exe
                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2u67lozl\oqe863bd.exe
                                                                                    2⤵
                                                                                      PID:8180
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bvqagi4\at1wb3yu.exe"
                                                                                        3⤵
                                                                                          PID:7200
                                                                                          • C:\Windows\system32\attrib.exe
                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bvqagi4\at1wb3yu.exe"
                                                                                            4⤵
                                                                                              PID:4808
                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bvqagi4\at1wb3yu.exe
                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bvqagi4\at1wb3yu.exe
                                                                                        1⤵
                                                                                          PID:7404
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bvqagi4\at1wb3yu.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bvqagi4\at1wb3yu.exe
                                                                                            2⤵
                                                                                              PID:7588
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yykfqcov\wrfampem.exe"
                                                                                                3⤵
                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                PID:7664
                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yykfqcov\wrfampem.exe"
                                                                                                  4⤵
                                                                                                  • Views/modifies file attributes
                                                                                                  PID:7692
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yykfqcov\wrfampem.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yykfqcov\wrfampem.exe
                                                                                            1⤵
                                                                                              PID:7976
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yykfqcov\wrfampem.exe
                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yykfqcov\wrfampem.exe
                                                                                                2⤵
                                                                                                  PID:8056
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1f306k66\2rhvwhc3.exe"
                                                                                                    3⤵
                                                                                                      PID:8164
                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1f306k66\2rhvwhc3.exe"
                                                                                                        4⤵
                                                                                                        • Views/modifies file attributes
                                                                                                        PID:7216
                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1f306k66\2rhvwhc3.exe
                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1f306k66\2rhvwhc3.exe
                                                                                                  1⤵
                                                                                                    PID:4728
                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1f306k66\2rhvwhc3.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1f306k66\2rhvwhc3.exe
                                                                                                      2⤵
                                                                                                        PID:7788
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cg4v0g6g\ahy9f4x2.exe"
                                                                                                          3⤵
                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                          PID:7628
                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cg4v0g6g\ahy9f4x2.exe"
                                                                                                            4⤵
                                                                                                            • Views/modifies file attributes
                                                                                                            PID:7988
                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cg4v0g6g\ahy9f4x2.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cg4v0g6g\ahy9f4x2.exe
                                                                                                      1⤵
                                                                                                        PID:8176
                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cg4v0g6g\ahy9f4x2.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cg4v0g6g\ahy9f4x2.exe
                                                                                                          2⤵
                                                                                                            PID:7292
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ydr2ilzc\yuicipsv.exe"
                                                                                                              3⤵
                                                                                                                PID:7660
                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ydr2ilzc\yuicipsv.exe"
                                                                                                                  4⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:7828
                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ydr2ilzc\yuicipsv.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ydr2ilzc\yuicipsv.exe
                                                                                                            1⤵
                                                                                                              PID:7220
                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ydr2ilzc\yuicipsv.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ydr2ilzc\yuicipsv.exe
                                                                                                                2⤵
                                                                                                                  PID:7848
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co39o1vc\1thssmm1.exe"
                                                                                                                    3⤵
                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                    PID:7928
                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co39o1vc\1thssmm1.exe"
                                                                                                                      4⤵
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:7632
                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co39o1vc\1thssmm1.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co39o1vc\1thssmm1.exe
                                                                                                                1⤵
                                                                                                                  PID:3300
                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co39o1vc\1thssmm1.exe
                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\co39o1vc\1thssmm1.exe
                                                                                                                    2⤵
                                                                                                                      PID:8228
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ziiismcp\he5ji8l1.exe"
                                                                                                                        3⤵
                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                        PID:8288
                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ziiismcp\he5ji8l1.exe"
                                                                                                                          4⤵
                                                                                                                            PID:8344
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ziiismcp\he5ji8l1.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ziiismcp\he5ji8l1.exe
                                                                                                                      1⤵
                                                                                                                        PID:8516
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ziiismcp\he5ji8l1.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ziiismcp\he5ji8l1.exe
                                                                                                                          2⤵
                                                                                                                            PID:8588
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smez5gh3\xiovyr4m.exe"
                                                                                                                              3⤵
                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                              PID:8652
                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smez5gh3\xiovyr4m.exe"
                                                                                                                                4⤵
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:8704
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smez5gh3\xiovyr4m.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smez5gh3\xiovyr4m.exe
                                                                                                                          1⤵
                                                                                                                            PID:8848
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smez5gh3\xiovyr4m.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smez5gh3\xiovyr4m.exe
                                                                                                                              2⤵
                                                                                                                                PID:8928
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bywpa2gj\z0mhjg5g.exe"
                                                                                                                                  3⤵
                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                  PID:8972
                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bywpa2gj\z0mhjg5g.exe"
                                                                                                                                    4⤵
                                                                                                                                    • Views/modifies file attributes
                                                                                                                                    PID:9016
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bywpa2gj\z0mhjg5g.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bywpa2gj\z0mhjg5g.exe
                                                                                                                              1⤵
                                                                                                                                PID:9172
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bywpa2gj\z0mhjg5g.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bywpa2gj\z0mhjg5g.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:5104
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\idk47gch\pwxs8j54.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                      PID:8300
                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\idk47gch\pwxs8j54.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:8296
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\idk47gch\pwxs8j54.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\idk47gch\pwxs8j54.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:8644
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\idk47gch\pwxs8j54.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\idk47gch\pwxs8j54.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:8756
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bpsnjiy\ytzn8hpb.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                            PID:8896
                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bpsnjiy\ytzn8hpb.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Views/modifies file attributes
                                                                                                                                              PID:8992
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bpsnjiy\ytzn8hpb.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bpsnjiy\ytzn8hpb.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:8296
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bpsnjiy\ytzn8hpb.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3bpsnjiy\ytzn8hpb.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:8472
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ll49iftq\mjzmyowd.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                PID:8572
                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ll49iftq\mjzmyowd.exe"
                                                                                                                                                  4⤵
                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                  PID:8728
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ll49iftq\mjzmyowd.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ll49iftq\mjzmyowd.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:8320
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ll49iftq\mjzmyowd.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ll49iftq\mjzmyowd.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:4616
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tzx2jgo1\bprud0x0.exe"
                                                                                                                                                    3⤵
                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                    PID:8656
                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tzx2jgo1\bprud0x0.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4744
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tzx2jgo1\bprud0x0.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tzx2jgo1\bprud0x0.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3168
                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tzx2jgo1\bprud0x0.exe
                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tzx2jgo1\bprud0x0.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:9012
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3klqfrbw\t96m8mf8.exe"
                                                                                                                                                          3⤵
                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                          PID:9240
                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3klqfrbw\t96m8mf8.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:9288
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3klqfrbw\t96m8mf8.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3klqfrbw\t96m8mf8.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:9412
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3klqfrbw\t96m8mf8.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3klqfrbw\t96m8mf8.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:9492
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ysu10kp6\pylgvrcv.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                PID:9532
                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ysu10kp6\pylgvrcv.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                  PID:9580
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ysu10kp6\pylgvrcv.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ysu10kp6\pylgvrcv.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:9764
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ysu10kp6\pylgvrcv.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ysu10kp6\pylgvrcv.exe
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:9840
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzafkru2\djo7gvfn.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                    PID:9880
                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzafkru2\djo7gvfn.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                      PID:9932
                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzafkru2\djo7gvfn.exe
                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzafkru2\djo7gvfn.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:10120
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzafkru2\djo7gvfn.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wzafkru2\djo7gvfn.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:10192
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnr26mxr\4qgbbdxt.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                        PID:10236
                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnr26mxr\4qgbbdxt.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                          PID:9304
                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnr26mxr\4qgbbdxt.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnr26mxr\4qgbbdxt.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:9428
                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnr26mxr\4qgbbdxt.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vnr26mxr\4qgbbdxt.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:9592
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgx3blva\9daavad6.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                            PID:9536
                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgx3blva\9daavad6.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:9084
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgx3blva\9daavad6.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgx3blva\9daavad6.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:8
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgx3blva\9daavad6.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tgx3blva\9daavad6.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:9924
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfhop32a\5c2hc20i.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                  PID:9980
                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfhop32a\5c2hc20i.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:10068
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfhop32a\5c2hc20i.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfhop32a\5c2hc20i.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4492
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfhop32a\5c2hc20i.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\jfhop32a\5c2hc20i.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4832
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dyv186xz\sboemgta.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                        PID:2860
                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dyv186xz\sboemgta.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                          PID:9452
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dyv186xz\sboemgta.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dyv186xz\sboemgta.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:2232
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dyv186xz\sboemgta.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dyv186xz\sboemgta.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:2396
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\47bvx5g3\868x9c9e.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                            PID:1228
                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\47bvx5g3\868x9c9e.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:2304
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\47bvx5g3\868x9c9e.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\47bvx5g3\868x9c9e.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2700
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\47bvx5g3\868x9c9e.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\47bvx5g3\868x9c9e.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1376
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pk84a0q1\bhymfv2z.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                PID:9928
                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pk84a0q1\bhymfv2z.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                  PID:9932
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pk84a0q1\bhymfv2z.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pk84a0q1\bhymfv2z.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3396
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pk84a0q1\bhymfv2z.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pk84a0q1\bhymfv2z.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2304
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvbv0dem\mbcyyo9d.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvbv0dem\mbcyyo9d.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                      PID:5268
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvbv0dem\mbcyyo9d.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvbv0dem\mbcyyo9d.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3928
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvbv0dem\mbcyyo9d.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kvbv0dem\mbcyyo9d.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:6432
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9wrnrfm\8yt59m1r.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                        PID:5268
                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9wrnrfm\8yt59m1r.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9wrnrfm\8yt59m1r.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9wrnrfm\8yt59m1r.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5868
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9wrnrfm\8yt59m1r.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\h9wrnrfm\8yt59m1r.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:636
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\luuqf20h\ofwo6f2a.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:2944
                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\luuqf20h\ofwo6f2a.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                PID:10292
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\luuqf20h\ofwo6f2a.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\luuqf20h\ofwo6f2a.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:10416
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\luuqf20h\ofwo6f2a.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\luuqf20h\ofwo6f2a.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:10488
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b61sstgw\h0qm08yr.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                  PID:10524
                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b61sstgw\h0qm08yr.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                    PID:10588
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b61sstgw\h0qm08yr.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b61sstgw\h0qm08yr.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:10696
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b61sstgw\h0qm08yr.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b61sstgw\h0qm08yr.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:10780
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qegmk35m\inxw625j.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                      PID:10816
                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qegmk35m\inxw625j.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                        PID:10880
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qegmk35m\inxw625j.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qegmk35m\inxw625j.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:10972
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qegmk35m\inxw625j.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qegmk35m\inxw625j.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:11052
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j73d2359\zoke2fkz.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:11100
                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j73d2359\zoke2fkz.exe"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:11164
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j73d2359\zoke2fkz.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j73d2359\zoke2fkz.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j73d2359\zoke2fkz.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j73d2359\zoke2fkz.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:6116
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewr0y2yc\k9g9ve5g.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                  PID:10440
                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewr0y2yc\k9g9ve5g.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                    PID:10484
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewr0y2yc\k9g9ve5g.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewr0y2yc\k9g9ve5g.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewr0y2yc\k9g9ve5g.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ewr0y2yc\k9g9ve5g.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:10708
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fc26r0f1\ee918lfj.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                      PID:10772
                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fc26r0f1\ee918lfj.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                        PID:10836
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fc26r0f1\ee918lfj.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fc26r0f1\ee918lfj.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:10672
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fc26r0f1\ee918lfj.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fc26r0f1\ee918lfj.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:11156
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pe4ca9n\sj93g94z.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                          PID:11236
                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pe4ca9n\sj93g94z.exe"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                            PID:5940
                                                                                                                                                                                                                                    • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                                                                                      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:5840
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pe4ca9n\sj93g94z.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pe4ca9n\sj93g94z.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pe4ca9n\sj93g94z.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0pe4ca9n\sj93g94z.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:6436
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ufiqvyvv\wtzl9nwl.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                PID:10856
                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ufiqvyvv\wtzl9nwl.exe"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ufiqvyvv\wtzl9nwl.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ufiqvyvv\wtzl9nwl.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:11168
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ufiqvyvv\wtzl9nwl.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ufiqvyvv\wtzl9nwl.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:11216
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\54mr060x\fs367slv.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5944
                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\54mr060x\fs367slv.exe"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                        PID:10300
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\54mr060x\fs367slv.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\54mr060x\fs367slv.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:1040
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\54mr060x\fs367slv.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\54mr060x\fs367slv.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:8768
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\04xjbkql\xddw8cxs.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3584
                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\04xjbkql\xddw8cxs.exe"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                              PID:6716
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\04xjbkql\xddw8cxs.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\04xjbkql\xddw8cxs.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:11128
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\04xjbkql\xddw8cxs.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\04xjbkql\xddw8cxs.exe
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:10300
                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nzfvmmo5\fgq6lush.exe"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                PID:5468
                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nzfvmmo5\fgq6lush.exe"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:10476
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nzfvmmo5\fgq6lush.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nzfvmmo5\fgq6lush.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nzfvmmo5\fgq6lush.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nzfvmmo5\fgq6lush.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bwacsx4\pidkb8zl.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                    PID:6908
                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bwacsx4\pidkb8zl.exe"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                      PID:780
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bwacsx4\pidkb8zl.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bwacsx4\pidkb8zl.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:3024
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bwacsx4\pidkb8zl.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6bwacsx4\pidkb8zl.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:6192
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qrtqdjl7\f0x2znr1.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:6844
                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qrtqdjl7\f0x2znr1.exe"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:7176
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qrtqdjl7\f0x2znr1.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qrtqdjl7\f0x2znr1.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:10260
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qrtqdjl7\f0x2znr1.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qrtqdjl7\f0x2znr1.exe
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:7776
                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zkkgozx\k1cag8xz.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                PID:10776
                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zkkgozx\k1cag8xz.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                  PID:10868
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zkkgozx\k1cag8xz.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zkkgozx\k1cag8xz.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:9660
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zkkgozx\k1cag8xz.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6zkkgozx\k1cag8xz.exe
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6716
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r198mjzb\7ro0oc0o.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                    PID:7812
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r198mjzb\7ro0oc0o.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:7900
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r198mjzb\7ro0oc0o.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r198mjzb\7ro0oc0o.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:7316
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r198mjzb\7ro0oc0o.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r198mjzb\7ro0oc0o.exe
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:7692
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qh6t7ck5\o0svpfyj.exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1112
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qh6t7ck5\o0svpfyj.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:8168
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qh6t7ck5\o0svpfyj.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qh6t7ck5\o0svpfyj.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:7312
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qh6t7ck5\o0svpfyj.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qh6t7ck5\o0svpfyj.exe
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:11328
                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kds4uqzp\065l4hqs.exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                  PID:11360
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kds4uqzp\065l4hqs.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                    PID:11416
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kds4uqzp\065l4hqs.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kds4uqzp\065l4hqs.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:11512
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kds4uqzp\065l4hqs.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kds4uqzp\065l4hqs.exe
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:11592
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\84u1pgzu\t0wflrhn.exe"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                      PID:11636
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\84u1pgzu\t0wflrhn.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                        PID:11680
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\84u1pgzu\t0wflrhn.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\84u1pgzu\t0wflrhn.exe
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:11820
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\84u1pgzu\t0wflrhn.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\84u1pgzu\t0wflrhn.exe
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:11908
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\li47fdme\m15x9s31.exe"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:11940
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\li47fdme\m15x9s31.exe"
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:11984
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\li47fdme\m15x9s31.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\li47fdme\m15x9s31.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:12140
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\li47fdme\m15x9s31.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\li47fdme\m15x9s31.exe
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:12224
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7javbj0\2lj2w8u2.exe"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                  PID:12264
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7javbj0\2lj2w8u2.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                    PID:11308
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7javbj0\2lj2w8u2.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7javbj0\2lj2w8u2.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:11564
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7javbj0\2lj2w8u2.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\v7javbj0\2lj2w8u2.exe
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:11656
                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wj9b0cw\0ngrul87.exe"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:1612
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wj9b0cw\0ngrul87.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wj9b0cw\0ngrul87.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wj9b0cw\0ngrul87.exe
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:11980
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wj9b0cw\0ngrul87.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6wj9b0cw\0ngrul87.exe
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:12060
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\azz3m9rm\oug4f9uf.exe"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                            PID:8596
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\azz3m9rm\oug4f9uf.exe"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                              PID:12200
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\azz3m9rm\oug4f9uf.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\azz3m9rm\oug4f9uf.exe
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:11384
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\azz3m9rm\oug4f9uf.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\azz3m9rm\oug4f9uf.exe
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:11588
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2loebtz\kfa3vca6.exe"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                PID:1920
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2loebtz\kfa3vca6.exe"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                  PID:5532
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2loebtz\kfa3vca6.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2loebtz\kfa3vca6.exe
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:12064
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2loebtz\kfa3vca6.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\l2loebtz\kfa3vca6.exe
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:12164
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wb4qbo0p\zdhhd3ay.exe"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                    PID:400
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wb4qbo0p\zdhhd3ay.exe"
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                      PID:8664
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wb4qbo0p\zdhhd3ay.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wb4qbo0p\zdhhd3ay.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:11752
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wb4qbo0p\zdhhd3ay.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wb4qbo0p\zdhhd3ay.exe
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:9728
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6vg23ny\ewp5o3jt.exe"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:2656
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6vg23ny\ewp5o3jt.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:4352
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6vg23ny\ewp5o3jt.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6vg23ny\ewp5o3jt.exe
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:8324
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6vg23ny\ewp5o3jt.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e6vg23ny\ewp5o3jt.exe
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:8764
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvt247zz\b8wq16ih.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                PID:3692
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvt247zz\b8wq16ih.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                  PID:4424
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvt247zz\b8wq16ih.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvt247zz\b8wq16ih.exe
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:216
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvt247zz\b8wq16ih.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cvt247zz\b8wq16ih.exe
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4352
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2jeoudzq\97d0cw53.exe"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:11624
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2jeoudzq\97d0cw53.exe"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                        PID:7196
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2jeoudzq\97d0cw53.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2jeoudzq\97d0cw53.exe
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:12308
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2jeoudzq\97d0cw53.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2jeoudzq\97d0cw53.exe
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:12388
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu4hvnji\866ap0l5.exe"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                          PID:12420
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu4hvnji\866ap0l5.exe"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                            PID:12480
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu4hvnji\866ap0l5.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu4hvnji\866ap0l5.exe
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:12624
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu4hvnji\866ap0l5.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\yu4hvnji\866ap0l5.exe
                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                            PID:12712
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l61mdeq\f8jahczy.exe"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                              PID:12756
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l61mdeq\f8jahczy.exe"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                PID:12812
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l61mdeq\f8jahczy.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l61mdeq\f8jahczy.exe
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:12948
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l61mdeq\f8jahczy.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6l61mdeq\f8jahczy.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:13044
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6f8u7nos\pkjl6w1v.exe"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:13072
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6f8u7nos\pkjl6w1v.exe"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:13128
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6f8u7nos\pkjl6w1v.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6f8u7nos\pkjl6w1v.exe
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:13268
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6f8u7nos\pkjl6w1v.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6f8u7nos\pkjl6w1v.exe
                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:12344
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uuqsd3z\0t2shega.exe"
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9756
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uuqsd3z\0t2shega.exe"
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:12484
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uuqsd3z\0t2shega.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uuqsd3z\0t2shega.exe
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:12544
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uuqsd3z\0t2shega.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uuqsd3z\0t2shega.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:10128
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1dsje9j4\224kh5ds.exe"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                  PID:12768
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1dsje9j4\224kh5ds.exe"
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                    PID:4124

                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                  README_DECRYPT.txt
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\3D Objects\README_DECRYPT.txt
                                                                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5ade33911c578fa740e551a065043a7d145f847f1a2c33f17f6847509a368740
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Size 94KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 265KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 64KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 159KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 78KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 151KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  _uuid.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\_uuid.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                  • Size 711KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 13050add87127fd5066c087667e775905ee61f7777d91e5a89c38d3140b0b7fc
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Size 678KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  python39.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\python39.dll
                                                                                                                                                                                                                                                                                                                                                                                  • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  select.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\select.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI13202\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                  • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  y9t3bjd0.exe
                                                                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3uk8pbxg\y9t3bjd0.exe
                                                                                                                                                                                                                                                                                                                                                                                  • Size 5.4MB
                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 454e1c87dfcb1f7ae9925cb755b44cc7c0486ef1b24e9e409bfba2a0ec91dc47
                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                  memory/1504-384-0x0000015E58380000-0x0000015E58494000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                  Download