Overview

overview

7

Static

static

3

2026-09-10...om.exe

windows10-2004-x64

7

2026-09-10...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    32s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 19:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_1c69249a569f62e9527ff738bb211894_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 5.4MB
  • Sample260910-x4gb1sfr21
  • SHA256 320efb1faa83c4c2cc637404802ff05a0a159f15d197ba925bae0afeec27cb0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationpyinstaller

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 42 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 21 IoCs
    persistence
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 64 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 64 IoCs
    defense_evasion
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious use of WriteProcessMemory 63 IoCs
  • Views/modifies file attributes 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_1c69249a569f62e9527ff738bb211894_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_1c69249a569f62e9527ff738bb211894_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4520
    • C:\Users\Admin\AppData\Local\Temp\2026-09-10_1c69249a569f62e9527ff738bb211894_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-10_1c69249a569f62e9527ff738bb211894_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5100
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe"
          4⤵
          • Views/modifies file attributes
          PID:384
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tz6qlddl\dgycl1tx.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4476
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tz6qlddl\dgycl1tx.exe"
          4⤵
          • Views/modifies file attributes
          PID:1888
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tz6qlddl\dgycl1tx.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tz6qlddl\dgycl1tx.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3112
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tz6qlddl\dgycl1tx.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tz6qlddl\dgycl1tx.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y2f0dmsq\c3h7f3yd.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y2f0dmsq\c3h7f3yd.exe"
          4⤵
          • Views/modifies file attributes
          PID:1044
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y2f0dmsq\c3h7f3yd.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y2f0dmsq\c3h7f3yd.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y2f0dmsq\c3h7f3yd.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y2f0dmsq\c3h7f3yd.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re0nu2ot\5bzq33xp.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re0nu2ot\5bzq33xp.exe"
          4⤵
          • Views/modifies file attributes
          PID:3116
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re0nu2ot\5bzq33xp.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re0nu2ot\5bzq33xp.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re0nu2ot\5bzq33xp.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\re0nu2ot\5bzq33xp.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5x6rwsxr\3pep8udp.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5000
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5x6rwsxr\3pep8udp.exe"
          4⤵
          • Views/modifies file attributes
          PID:3828
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5x6rwsxr\3pep8udp.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5x6rwsxr\3pep8udp.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5x6rwsxr\3pep8udp.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5x6rwsxr\3pep8udp.exe
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dedsfc0j\0cyeonfy.exe"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dedsfc0j\0cyeonfy.exe"
          4⤵
            PID:3900
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dedsfc0j\0cyeonfy.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dedsfc0j\0cyeonfy.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dedsfc0j\0cyeonfy.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dedsfc0j\0cyeonfy.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:972
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pap55wl1\hekag9y2.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pap55wl1\hekag9y2.exe"
            4⤵
            • Views/modifies file attributes
            PID:2264
    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pap55wl1\hekag9y2.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pap55wl1\hekag9y2.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pap55wl1\hekag9y2.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pap55wl1\hekag9y2.exe
        2⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36oh033l\gw4mdph2.exe"
          3⤵
          • Hide Artifacts: Hidden Files and Directories
          • Suspicious use of WriteProcessMemory
          PID:2336
          • C:\Windows\system32\attrib.exe
            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36oh033l\gw4mdph2.exe"
            4⤵
              PID:1200
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36oh033l\gw4mdph2.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36oh033l\gw4mdph2.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36oh033l\gw4mdph2.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36oh033l\gw4mdph2.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4968
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n9q1ydvv\lc7pl8ny.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3360
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n9q1ydvv\lc7pl8ny.exe"
              4⤵
              • Views/modifies file attributes
              PID:4040
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n9q1ydvv\lc7pl8ny.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n9q1ydvv\lc7pl8ny.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3956
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n9q1ydvv\lc7pl8ny.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n9q1ydvv\lc7pl8ny.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4068
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oyj1govw\4mf4rz1r.exe"
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:3780
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oyj1govw\4mf4rz1r.exe"
              4⤵
              • Views/modifies file attributes
              PID:2724
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oyj1govw\4mf4rz1r.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oyj1govw\4mf4rz1r.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oyj1govw\4mf4rz1r.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oyj1govw\4mf4rz1r.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf97v62f\tati5gnz.exe"
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:3872
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf97v62f\tati5gnz.exe"
              4⤵
              • Views/modifies file attributes
              PID:2564
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf97v62f\tati5gnz.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf97v62f\tati5gnz.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf97v62f\tati5gnz.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\wf97v62f\tati5gnz.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3de8ol3\yithjtmo.exe"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2140
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3de8ol3\yithjtmo.exe"
              4⤵
              • Views/modifies file attributes
              PID:816
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3de8ol3\yithjtmo.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3de8ol3\yithjtmo.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3de8ol3\yithjtmo.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g3de8ol3\yithjtmo.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4788
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov6bc224\9mbmgjc3.exe"
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:3472
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov6bc224\9mbmgjc3.exe"
              4⤵
              • Views/modifies file attributes
              PID:1496
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov6bc224\9mbmgjc3.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov6bc224\9mbmgjc3.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3412
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov6bc224\9mbmgjc3.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ov6bc224\9mbmgjc3.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdovrg8t\afxvchwk.exe"
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:5024
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdovrg8t\afxvchwk.exe"
              4⤵
              • Views/modifies file attributes
              PID:2736
      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdovrg8t\afxvchwk.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdovrg8t\afxvchwk.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdovrg8t\afxvchwk.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\hdovrg8t\afxvchwk.exe
          2⤵
          • Creates a file in the Startup directory
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2264
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36okw03p\i2ascub1.exe"
            3⤵
            • Hide Artifacts: Hidden Files and Directories
            • Suspicious use of WriteProcessMemory
            PID:2212
            • C:\Windows\system32\attrib.exe
              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36okw03p\i2ascub1.exe"
              4⤵
                PID:3580
        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36okw03p\i2ascub1.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36okw03p\i2ascub1.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:776
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36okw03p\i2ascub1.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\36okw03p\i2ascub1.exe
            2⤵
            • Creates a file in the Startup directory
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1608
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9ml8zlq\h3ul5zgx.exe"
              3⤵
              • Hide Artifacts: Hidden Files and Directories
              • Suspicious use of WriteProcessMemory
              PID:3096
              • C:\Windows\system32\attrib.exe
                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9ml8zlq\h3ul5zgx.exe"
                4⤵
                  PID:3580
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9ml8zlq\h3ul5zgx.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9ml8zlq\h3ul5zgx.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4564
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9ml8zlq\h3ul5zgx.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g9ml8zlq\h3ul5zgx.exe
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1168
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghmmy16e\9q4r3cxc.exe"
                3⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:4812
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghmmy16e\9q4r3cxc.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:4592
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghmmy16e\9q4r3cxc.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghmmy16e\9q4r3cxc.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5156
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghmmy16e\9q4r3cxc.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ghmmy16e\9q4r3cxc.exe
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:5228
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vw8mgv7r\jvaxaves.exe"
                3⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:5260
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vw8mgv7r\jvaxaves.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:5320
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vw8mgv7r\jvaxaves.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vw8mgv7r\jvaxaves.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5520
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vw8mgv7r\jvaxaves.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\vw8mgv7r\jvaxaves.exe
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:5640
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49c30mmk\7z3d3jxu.exe"
                3⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:5684
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49c30mmk\7z3d3jxu.exe"
                  4⤵
                  • Views/modifies file attributes
                  PID:5728
          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49c30mmk\7z3d3jxu.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49c30mmk\7z3d3jxu.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5840
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49c30mmk\7z3d3jxu.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\49c30mmk\7z3d3jxu.exe
              2⤵
              • Creates a file in the Startup directory
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:5928
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8k1ftpuj\9wfb9m58.exe"
                3⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:5996
                • C:\Windows\system32\attrib.exe
                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8k1ftpuj\9wfb9m58.exe"
                  4⤵
                    PID:6060
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8k1ftpuj\9wfb9m58.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8k1ftpuj\9wfb9m58.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5184
              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8k1ftpuj\9wfb9m58.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8k1ftpuj\9wfb9m58.exe
                2⤵
                • Creates a file in the Startup directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:5320
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xiqbnest\6ag3yzm1.exe"
                  3⤵
                  • Hide Artifacts: Hidden Files and Directories
                  • Suspicious use of WriteProcessMemory
                  PID:5288
                  • C:\Windows\system32\attrib.exe
                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xiqbnest\6ag3yzm1.exe"
                    4⤵
                    • Views/modifies file attributes
                    PID:5600
            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xiqbnest\6ag3yzm1.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xiqbnest\6ag3yzm1.exe
              1⤵
                PID:964
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xiqbnest\6ag3yzm1.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xiqbnest\6ag3yzm1.exe
                  2⤵
                    PID:6020
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cvgsf49\42grllvg.exe"
                      3⤵
                      • Hide Artifacts: Hidden Files and Directories
                      PID:5196
                      • C:\Windows\system32\attrib.exe
                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cvgsf49\42grllvg.exe"
                        4⤵
                        • Views/modifies file attributes
                        PID:5300
                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cvgsf49\42grllvg.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cvgsf49\42grllvg.exe
                  1⤵
                    PID:5576
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cvgsf49\42grllvg.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6cvgsf49\42grllvg.exe
                      2⤵
                        PID:5964
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y0uvne88\hdqcc3ma.exe"
                          3⤵
                          • Hide Artifacts: Hidden Files and Directories
                          PID:5992
                          • C:\Windows\system32\attrib.exe
                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y0uvne88\hdqcc3ma.exe"
                            4⤵
                            • Views/modifies file attributes
                            PID:6000
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y0uvne88\hdqcc3ma.exe
                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y0uvne88\hdqcc3ma.exe
                      1⤵
                        PID:3480
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y0uvne88\hdqcc3ma.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y0uvne88\hdqcc3ma.exe
                          2⤵
                            PID:5224
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppknghq3\4jrqmh0t.exe"
                              3⤵
                                PID:5988
                                • C:\Windows\system32\attrib.exe
                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppknghq3\4jrqmh0t.exe"
                                  4⤵
                                    PID:6008
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppknghq3\4jrqmh0t.exe
                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppknghq3\4jrqmh0t.exe
                              1⤵
                                PID:5904
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppknghq3\4jrqmh0t.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppknghq3\4jrqmh0t.exe
                                  2⤵
                                    PID:5200
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cfkk8172\bkbn8gl5.exe"
                                      3⤵
                                      • Hide Artifacts: Hidden Files and Directories
                                      PID:6168
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cfkk8172\bkbn8gl5.exe"
                                        4⤵
                                        • Views/modifies file attributes
                                        PID:6228
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cfkk8172\bkbn8gl5.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cfkk8172\bkbn8gl5.exe
                                  1⤵
                                    PID:6312
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cfkk8172\bkbn8gl5.exe
                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\cfkk8172\bkbn8gl5.exe
                                      2⤵
                                        PID:6384
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smvkxrh4\aouoag0z.exe"
                                          3⤵
                                          • Hide Artifacts: Hidden Files and Directories
                                          PID:6428
                                          • C:\Windows\system32\attrib.exe
                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smvkxrh4\aouoag0z.exe"
                                            4⤵
                                            • Views/modifies file attributes
                                            PID:6484
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smvkxrh4\aouoag0z.exe
                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smvkxrh4\aouoag0z.exe
                                      1⤵
                                        PID:6592
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smvkxrh4\aouoag0z.exe
                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smvkxrh4\aouoag0z.exe
                                          2⤵
                                            PID:6664
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smrkqrrb\ggnnwfho.exe"
                                              3⤵
                                              • Hide Artifacts: Hidden Files and Directories
                                              PID:6704
                                              • C:\Windows\system32\attrib.exe
                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smrkqrrb\ggnnwfho.exe"
                                                4⤵
                                                  PID:6752
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smrkqrrb\ggnnwfho.exe
                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smrkqrrb\ggnnwfho.exe
                                            1⤵
                                              PID:6840
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smrkqrrb\ggnnwfho.exe
                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\smrkqrrb\ggnnwfho.exe
                                                2⤵
                                                  PID:6912
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdg90mfk\ir8bduf3.exe"
                                                    3⤵
                                                    • Hide Artifacts: Hidden Files and Directories
                                                    PID:6952
                                                    • C:\Windows\system32\attrib.exe
                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdg90mfk\ir8bduf3.exe"
                                                      4⤵
                                                      • Views/modifies file attributes
                                                      PID:7012
                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdg90mfk\ir8bduf3.exe
                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdg90mfk\ir8bduf3.exe
                                                1⤵
                                                  PID:7124
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdg90mfk\ir8bduf3.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\gdg90mfk\ir8bduf3.exe
                                                    2⤵
                                                      PID:6232
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dk5rn1eh\jstk91j0.exe"
                                                        3⤵
                                                        • Hide Artifacts: Hidden Files and Directories
                                                        PID:6272
                                                        • C:\Windows\system32\attrib.exe
                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dk5rn1eh\jstk91j0.exe"
                                                          4⤵
                                                          • Views/modifies file attributes
                                                          PID:6376
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dk5rn1eh\jstk91j0.exe
                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dk5rn1eh\jstk91j0.exe
                                                    1⤵
                                                      PID:6508
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dk5rn1eh\jstk91j0.exe
                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dk5rn1eh\jstk91j0.exe
                                                        2⤵
                                                          PID:6660
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bz93bk6l\a4gr8kkq.exe"
                                                            3⤵
                                                              PID:6760
                                                              • C:\Windows\system32\attrib.exe
                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bz93bk6l\a4gr8kkq.exe"
                                                                4⤵
                                                                  PID:6808
                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bz93bk6l\a4gr8kkq.exe
                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bz93bk6l\a4gr8kkq.exe
                                                            1⤵
                                                              PID:7016
                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bz93bk6l\a4gr8kkq.exe
                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\bz93bk6l\a4gr8kkq.exe
                                                                2⤵
                                                                  PID:7136
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p6zyw6ce\y4d2l2yo.exe"
                                                                    3⤵
                                                                      PID:6156
                                                                      • C:\Windows\system32\attrib.exe
                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p6zyw6ce\y4d2l2yo.exe"
                                                                        4⤵
                                                                        • Views/modifies file attributes
                                                                        PID:4144
                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p6zyw6ce\y4d2l2yo.exe
                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p6zyw6ce\y4d2l2yo.exe
                                                                  1⤵
                                                                    PID:6620
                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p6zyw6ce\y4d2l2yo.exe
                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\p6zyw6ce\y4d2l2yo.exe
                                                                      2⤵
                                                                        PID:6808
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j9znnkwe\tr3xnaf5.exe"
                                                                          3⤵
                                                                            PID:6744
                                                                            • C:\Windows\system32\attrib.exe
                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j9znnkwe\tr3xnaf5.exe"
                                                                              4⤵
                                                                              • Views/modifies file attributes
                                                                              PID:7032
                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j9znnkwe\tr3xnaf5.exe
                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j9znnkwe\tr3xnaf5.exe
                                                                        1⤵
                                                                          PID:6260
                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j9znnkwe\tr3xnaf5.exe
                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\j9znnkwe\tr3xnaf5.exe
                                                                            2⤵
                                                                              PID:6728
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19e71vcc\xupqfk60.exe"
                                                                                3⤵
                                                                                  PID:6732
                                                                                  • C:\Windows\system32\attrib.exe
                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19e71vcc\xupqfk60.exe"
                                                                                    4⤵
                                                                                    • Views/modifies file attributes
                                                                                    PID:6884
                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19e71vcc\xupqfk60.exe
                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19e71vcc\xupqfk60.exe
                                                                              1⤵
                                                                                PID:6864
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19e71vcc\xupqfk60.exe
                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\19e71vcc\xupqfk60.exe
                                                                                  2⤵
                                                                                    PID:7140
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js26vtkz\pg5xzv76.exe"
                                                                                      3⤵
                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                      PID:6984
                                                                                      • C:\Windows\system32\attrib.exe
                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js26vtkz\pg5xzv76.exe"
                                                                                        4⤵
                                                                                        • Views/modifies file attributes
                                                                                        PID:7180
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js26vtkz\pg5xzv76.exe
                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js26vtkz\pg5xzv76.exe
                                                                                  1⤵
                                                                                    PID:7276
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js26vtkz\pg5xzv76.exe
                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\js26vtkz\pg5xzv76.exe
                                                                                      2⤵
                                                                                        PID:7348
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44u40602\v5rq45mh.exe"
                                                                                          3⤵
                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                          PID:7396
                                                                                          • C:\Windows\system32\attrib.exe
                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44u40602\v5rq45mh.exe"
                                                                                            4⤵
                                                                                              PID:7448
                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44u40602\v5rq45mh.exe
                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44u40602\v5rq45mh.exe
                                                                                        1⤵
                                                                                          PID:7540
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44u40602\v5rq45mh.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\44u40602\v5rq45mh.exe
                                                                                            2⤵
                                                                                              PID:7620
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nh6ex1c\t2sv12k3.exe"
                                                                                                3⤵
                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                PID:7652
                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nh6ex1c\t2sv12k3.exe"
                                                                                                  4⤵
                                                                                                  • Views/modifies file attributes
                                                                                                  PID:7708
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nh6ex1c\t2sv12k3.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nh6ex1c\t2sv12k3.exe
                                                                                            1⤵
                                                                                              PID:7800
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nh6ex1c\t2sv12k3.exe
                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6nh6ex1c\t2sv12k3.exe
                                                                                                2⤵
                                                                                                  PID:7872
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygi3fvnr\nae1d7kx.exe"
                                                                                                    3⤵
                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                    PID:7920
                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygi3fvnr\nae1d7kx.exe"
                                                                                                      4⤵
                                                                                                      • Views/modifies file attributes
                                                                                                      PID:7980
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygi3fvnr\nae1d7kx.exe
                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygi3fvnr\nae1d7kx.exe
                                                                                                1⤵
                                                                                                  PID:8092
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygi3fvnr\nae1d7kx.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ygi3fvnr\nae1d7kx.exe
                                                                                                    2⤵
                                                                                                      PID:8172
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qi3s4fxm\rueb5ysz.exe"
                                                                                                        3⤵
                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                        PID:7180
                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qi3s4fxm\rueb5ysz.exe"
                                                                                                          4⤵
                                                                                                            PID:7220
                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qi3s4fxm\rueb5ysz.exe
                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qi3s4fxm\rueb5ysz.exe
                                                                                                      1⤵
                                                                                                        PID:7408
                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qi3s4fxm\rueb5ysz.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qi3s4fxm\rueb5ysz.exe
                                                                                                          2⤵
                                                                                                            PID:7504
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kb3fxwno\qs6k8f5x.exe"
                                                                                                              3⤵
                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                              PID:7576
                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kb3fxwno\qs6k8f5x.exe"
                                                                                                                4⤵
                                                                                                                  PID:7664
                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kb3fxwno\qs6k8f5x.exe
                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kb3fxwno\qs6k8f5x.exe
                                                                                                            1⤵
                                                                                                              PID:7820
                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kb3fxwno\qs6k8f5x.exe
                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kb3fxwno\qs6k8f5x.exe
                                                                                                                2⤵
                                                                                                                  PID:7984
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g7l0r7dn\7barbyef.exe"
                                                                                                                    3⤵
                                                                                                                      PID:7952
                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g7l0r7dn\7barbyef.exe"
                                                                                                                        4⤵
                                                                                                                        • Views/modifies file attributes
                                                                                                                        PID:8120
                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g7l0r7dn\7barbyef.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g7l0r7dn\7barbyef.exe
                                                                                                                  1⤵
                                                                                                                    PID:7176
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g7l0r7dn\7barbyef.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\g7l0r7dn\7barbyef.exe
                                                                                                                      2⤵
                                                                                                                        PID:7440
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o84ilkpo\a3jx2flf.exe"
                                                                                                                          3⤵
                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                          PID:7596
                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o84ilkpo\a3jx2flf.exe"
                                                                                                                            4⤵
                                                                                                                            • Views/modifies file attributes
                                                                                                                            PID:7588
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o84ilkpo\a3jx2flf.exe
                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o84ilkpo\a3jx2flf.exe
                                                                                                                      1⤵
                                                                                                                        PID:8004
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o84ilkpo\a3jx2flf.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\o84ilkpo\a3jx2flf.exe
                                                                                                                          2⤵
                                                                                                                            PID:7956
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jyuvxdx\un9kltqr.exe"
                                                                                                                              3⤵
                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                              PID:7296
                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jyuvxdx\un9kltqr.exe"
                                                                                                                                4⤵
                                                                                                                                • Views/modifies file attributes
                                                                                                                                PID:7564
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jyuvxdx\un9kltqr.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jyuvxdx\un9kltqr.exe
                                                                                                                          1⤵
                                                                                                                            PID:7836
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jyuvxdx\un9kltqr.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5jyuvxdx\un9kltqr.exe
                                                                                                                              2⤵
                                                                                                                                PID:7196
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03gzopnk\t7s1kr8p.exe"
                                                                                                                                  3⤵
                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                  PID:5152
                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03gzopnk\t7s1kr8p.exe"
                                                                                                                                    4⤵
                                                                                                                                    • Views/modifies file attributes
                                                                                                                                    PID:7644
                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03gzopnk\t7s1kr8p.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03gzopnk\t7s1kr8p.exe
                                                                                                                              1⤵
                                                                                                                                PID:7640
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03gzopnk\t7s1kr8p.exe
                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\03gzopnk\t7s1kr8p.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:8128
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x9o2m83k\xfeo0taz.exe"
                                                                                                                                      3⤵
                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                      PID:8220
                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x9o2m83k\xfeo0taz.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:8284
                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x9o2m83k\xfeo0taz.exe
                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x9o2m83k\xfeo0taz.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:8388
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x9o2m83k\xfeo0taz.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\x9o2m83k\xfeo0taz.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:8460
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd13pp0j\jlm17nr9.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                            PID:8512
                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd13pp0j\jlm17nr9.exe"
                                                                                                                                              4⤵
                                                                                                                                              • Views/modifies file attributes
                                                                                                                                              PID:8576
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd13pp0j\jlm17nr9.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd13pp0j\jlm17nr9.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:8724
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd13pp0j\jlm17nr9.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\fd13pp0j\jlm17nr9.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:8812
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2o6vxcwv\cvxg70a1.exe"
                                                                                                                                                3⤵
                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                PID:8860
                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2o6vxcwv\cvxg70a1.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:8924
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2o6vxcwv\cvxg70a1.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2o6vxcwv\cvxg70a1.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:9052
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2o6vxcwv\cvxg70a1.exe
                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2o6vxcwv\cvxg70a1.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:9124
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\72gscq9n\o42ufmzz.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:9152
                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\72gscq9n\o42ufmzz.exe"
                                                                                                                                                          4⤵
                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                          PID:9204
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\72gscq9n\o42ufmzz.exe
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\72gscq9n\o42ufmzz.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:8320
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\72gscq9n\o42ufmzz.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\72gscq9n\o42ufmzz.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:8444
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e7wa1kcu\shaa6heg.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                            PID:1664
                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e7wa1kcu\shaa6heg.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                              PID:8592
                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e7wa1kcu\shaa6heg.exe
                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e7wa1kcu\shaa6heg.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:8768
                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e7wa1kcu\shaa6heg.exe
                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\e7wa1kcu\shaa6heg.exe
                                                                                                                                                            2⤵
                                                                                                                                                              PID:8896
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r9irucff\vfv8gl1x.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:8916
                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r9irucff\vfv8gl1x.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Views/modifies file attributes
                                                                                                                                                                    PID:3776
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r9irucff\vfv8gl1x.exe
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r9irucff\vfv8gl1x.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:9208
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r9irucff\vfv8gl1x.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\r9irucff\vfv8gl1x.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:8324
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\urs2vqg4\cy3kz7up.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:8440
                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\urs2vqg4\cy3kz7up.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:8524
                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\urs2vqg4\cy3kz7up.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\urs2vqg4\cy3kz7up.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:8908
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\urs2vqg4\cy3kz7up.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\urs2vqg4\cy3kz7up.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:9072
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8hzu8ytq\xqth6zqk.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                              PID:3368
                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8hzu8ytq\xqth6zqk.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                PID:8300
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8hzu8ytq\xqth6zqk.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8hzu8ytq\xqth6zqk.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:1120
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8hzu8ytq\xqth6zqk.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\8hzu8ytq\xqth6zqk.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:8252
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqr7k12h\99yuk1rj.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:9160
                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqr7k12h\99yuk1rj.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                      PID:1816
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqr7k12h\99yuk1rj.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqr7k12h\99yuk1rj.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4676
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqr7k12h\99yuk1rj.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dqr7k12h\99yuk1rj.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4536
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4ttskhd5\xp06rt9w.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                        PID:8424
                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4ttskhd5\xp06rt9w.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                          PID:9228
                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4ttskhd5\xp06rt9w.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4ttskhd5\xp06rt9w.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:9316
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4ttskhd5\xp06rt9w.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4ttskhd5\xp06rt9w.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:9396
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35g19lyn\5xyhep1u.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                            PID:9448
                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35g19lyn\5xyhep1u.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                              PID:9508
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35g19lyn\5xyhep1u.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35g19lyn\5xyhep1u.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:9628
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35g19lyn\5xyhep1u.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\35g19lyn\5xyhep1u.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:9700
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tarozwi4\2himpr8w.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                PID:9740
                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tarozwi4\2himpr8w.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                  PID:9792
                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tarozwi4\2himpr8w.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tarozwi4\2himpr8w.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:9924
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tarozwi4\2himpr8w.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\tarozwi4\2himpr8w.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:10004
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\px0cfsf9\oebs26ot.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                    PID:10036
                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\px0cfsf9\oebs26ot.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                      PID:10104
                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\px0cfsf9\oebs26ot.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\px0cfsf9\oebs26ot.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:10208
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\px0cfsf9\oebs26ot.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\px0cfsf9\oebs26ot.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3276
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n88xmiaj\v3s712s1.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:9328
                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n88xmiaj\v3s712s1.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                            PID:4416
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n88xmiaj\v3s712s1.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n88xmiaj\v3s712s1.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:10064
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n88xmiaj\v3s712s1.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n88xmiaj\v3s712s1.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3344
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nybr5h1u\ff97jffn.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                              PID:9240
                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nybr5h1u\ff97jffn.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:9252
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nybr5h1u\ff97jffn.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nybr5h1u\ff97jffn.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:1220
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nybr5h1u\ff97jffn.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\nybr5h1u\ff97jffn.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1932
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0bxgpskd\rg7l6088.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:9284
                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0bxgpskd\rg7l6088.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0bxgpskd\rg7l6088.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0bxgpskd\rg7l6088.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:10168
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0bxgpskd\rg7l6088.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\0bxgpskd\rg7l6088.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:3748
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13d04x5i\8nql541y.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                          PID:10224
                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13d04x5i\8nql541y.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                            PID:4004
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13d04x5i\8nql541y.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13d04x5i\8nql541y.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4380
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13d04x5i\8nql541y.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\13d04x5i\8nql541y.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1500
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3bzad44\q0vslehi.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1768
                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3bzad44\q0vslehi.exe"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3bzad44\q0vslehi.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3bzad44\q0vslehi.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:2124
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3bzad44\q0vslehi.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n3bzad44\q0vslehi.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:10316
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xfjo8lxk\23y8b6mm.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                      PID:10348
                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xfjo8lxk\23y8b6mm.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:10404
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xfjo8lxk\23y8b6mm.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xfjo8lxk\23y8b6mm.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:10528
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xfjo8lxk\23y8b6mm.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xfjo8lxk\23y8b6mm.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:10600
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\potvzydq\9kpmabvc.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                            PID:10636
                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\potvzydq\9kpmabvc.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                              PID:10684
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\potvzydq\9kpmabvc.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\potvzydq\9kpmabvc.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:10784
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\potvzydq\9kpmabvc.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\potvzydq\9kpmabvc.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:10856
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qonemjch\3mnk1611.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                PID:10884
                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qonemjch\3mnk1611.exe"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                  PID:10940
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qonemjch\3mnk1611.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qonemjch\3mnk1611.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:11052
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qonemjch\3mnk1611.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\qonemjch\3mnk1611.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:11124
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm2l1zs3\fa5keho7.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                    PID:11164
                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm2l1zs3\fa5keho7.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:11208
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm2l1zs3\fa5keho7.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm2l1zs3\fa5keho7.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm2l1zs3\fa5keho7.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xm2l1zs3\fa5keho7.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:10416
                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kp7ybuzt\745bnoxp.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                          PID:10420
                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kp7ybuzt\745bnoxp.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                            PID:10480
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kp7ybuzt\745bnoxp.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kp7ybuzt\745bnoxp.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:10700
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kp7ybuzt\745bnoxp.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kp7ybuzt\745bnoxp.exe
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mglgkf4\3m992u37.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                              PID:10852
                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mglgkf4\3m992u37.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                PID:10940
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mglgkf4\3m992u37.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mglgkf4\3m992u37.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:11112
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mglgkf4\3m992u37.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\9mglgkf4\3m992u37.exe
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:11192
                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zefzo1df\0lj80vs6.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                  PID:10304
                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zefzo1df\0lj80vs6.exe"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:10392
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zefzo1df\0lj80vs6.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zefzo1df\0lj80vs6.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zefzo1df\0lj80vs6.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\zefzo1df\0lj80vs6.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3636
                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ex4mtnnh\ev7ngu8x.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:10944
                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ex4mtnnh\ev7ngu8x.exe"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                            PID:10996
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ex4mtnnh\ev7ngu8x.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ex4mtnnh\ev7ngu8x.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:10388
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ex4mtnnh\ev7ngu8x.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ex4mtnnh\ev7ngu8x.exe
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iojc60e3\8ebtfpno.exe"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:10680
                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iojc60e3\8ebtfpno.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                  PID:3932
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iojc60e3\8ebtfpno.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iojc60e3\8ebtfpno.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:7932
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iojc60e3\8ebtfpno.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\iojc60e3\8ebtfpno.exe
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6yv6gte8\qdz9wehn.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                    PID:4100
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6yv6gte8\qdz9wehn.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                      PID:1272
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6yv6gte8\qdz9wehn.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6yv6gte8\qdz9wehn.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:6080
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6yv6gte8\qdz9wehn.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\6yv6gte8\qdz9wehn.exe
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:5220
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5bzglo\vfpntxcx.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                        PID:3032
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5bzglo\vfpntxcx.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:10740
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5bzglo\vfpntxcx.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5bzglo\vfpntxcx.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:1272
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5bzglo\vfpntxcx.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\1u5bzglo\vfpntxcx.exe
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:10476
                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcbjyj1z\4ti0n8d2.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                              PID:5216
                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcbjyj1z\4ti0n8d2.exe"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:5972
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcbjyj1z\4ti0n8d2.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcbjyj1z\4ti0n8d2.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:6056
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcbjyj1z\4ti0n8d2.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\dcbjyj1z\4ti0n8d2.exe
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:5756
                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lolqan9w\y5orj9dc.exe"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                    • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                    PID:6396
                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lolqan9w\y5orj9dc.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                      PID:11308
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lolqan9w\y5orj9dc.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lolqan9w\y5orj9dc.exe
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:11400
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lolqan9w\y5orj9dc.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\lolqan9w\y5orj9dc.exe
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:11472
                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4zupmizb\xvozzhzj.exe"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:11504
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4zupmizb\xvozzhzj.exe"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                            PID:11576
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4zupmizb\xvozzhzj.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4zupmizb\xvozzhzj.exe
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:11676
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4zupmizb\xvozzhzj.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\4zupmizb\xvozzhzj.exe
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:11748
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2lpvwn0j\18bdgyl9.exe"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:11780
                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2lpvwn0j\18bdgyl9.exe"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                  PID:11840
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2lpvwn0j\18bdgyl9.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2lpvwn0j\18bdgyl9.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:11924
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2lpvwn0j\18bdgyl9.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\2lpvwn0j\18bdgyl9.exe
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:11996
                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzzxfn4v\m0o6321g.exe"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:12040
                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzzxfn4v\m0o6321g.exe"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                        PID:12092
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzzxfn4v\m0o6321g.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzzxfn4v\m0o6321g.exe
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:12192
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzzxfn4v\m0o6321g.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xzzxfn4v\m0o6321g.exe
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:12264
                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xe9lp1n5\jaunej99.exe"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                          • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                          PID:11272
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xe9lp1n5\jaunej99.exe"
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                            PID:6320
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xe9lp1n5\jaunej99.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xe9lp1n5\jaunej99.exe
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:11520
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xe9lp1n5\jaunej99.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\xe9lp1n5\jaunej99.exe
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:11556
                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pm7e7bfp\0l4dq6km.exe"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                              PID:9308
                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pm7e7bfp\0l4dq6km.exe"
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                PID:11736
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pm7e7bfp\0l4dq6km.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pm7e7bfp\0l4dq6km.exe
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:11788
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pm7e7bfp\0l4dq6km.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\pm7e7bfp\0l4dq6km.exe
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:11976
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4m90o6f\1tfymxja.exe"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                  PID:12036
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4m90o6f\1tfymxja.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:12088
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4m90o6f\1tfymxja.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4m90o6f\1tfymxja.exe
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:6392
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4m90o6f\1tfymxja.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\y4m90o6f\1tfymxja.exe
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:7008
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b4b384em\jreqdpix.exe"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:7144
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b4b384em\jreqdpix.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:6772
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b4b384em\jreqdpix.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b4b384em\jreqdpix.exe
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:11704
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b4b384em\jreqdpix.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\b4b384em\jreqdpix.exe
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:11956
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ycv6ahom\2w5sf173.exe"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                PID:9624
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                  attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ycv6ahom\2w5sf173.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:12092
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ycv6ahom\2w5sf173.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ycv6ahom\2w5sf173.exe
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:11336
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ycv6ahom\2w5sf173.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ycv6ahom\2w5sf173.exe
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:11584
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5s4fm4vc\nnog57cx.exe"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                      • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                      PID:6636
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5s4fm4vc\nnog57cx.exe"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7808
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5s4fm4vc\nnog57cx.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5s4fm4vc\nnog57cx.exe
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:11968
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5s4fm4vc\nnog57cx.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5s4fm4vc\nnog57cx.exe
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6528
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93m4kojj\zm75jute.exe"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                            PID:8180
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93m4kojj\zm75jute.exe"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:11292
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93m4kojj\zm75jute.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93m4kojj\zm75jute.exe
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:11540
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93m4kojj\zm75jute.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\93m4kojj\zm75jute.exe
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4532
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y1bek7w\36v8nuk3.exe"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                  • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                  PID:6564
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y1bek7w\36v8nuk3.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7572
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y1bek7w\36v8nuk3.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y1bek7w\36v8nuk3.exe
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:996
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y1bek7w\36v8nuk3.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\3y1bek7w\36v8nuk3.exe
                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:9336
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldqemd3q\4tqcieao.exe"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:11268
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldqemd3q\4tqcieao.exe"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                            PID:7908
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldqemd3q\4tqcieao.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldqemd3q\4tqcieao.exe
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:12076
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldqemd3q\4tqcieao.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ldqemd3q\4tqcieao.exe
                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:11292
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppxyy565\2q1zguso.exe"
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                              • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                              PID:10272
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppxyy565\2q1zguso.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                PID:7448
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppxyy565\2q1zguso.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppxyy565\2q1zguso.exe
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:12312
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppxyy565\2q1zguso.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\ppxyy565\2q1zguso.exe
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:12396
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1g4vlc7\mtoylf4o.exe"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:12424
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1g4vlc7\mtoylf4o.exe"
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                      PID:12488
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1g4vlc7\mtoylf4o.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1g4vlc7\mtoylf4o.exe
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:12592
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1g4vlc7\mtoylf4o.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\c1g4vlc7\mtoylf4o.exe
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:12684
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n80juhtc\k7ytioou.exe"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                        PID:12716
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n80juhtc\k7ytioou.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                          PID:12796
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n80juhtc\k7ytioou.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n80juhtc\k7ytioou.exe
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:12908
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n80juhtc\k7ytioou.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\n80juhtc\k7ytioou.exe
                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:12984
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\endi6vin\x8cvdnul.exe"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Hide Artifacts: Hidden Files and Directories
                                                                                                                                                                                                                                                                                                                                                                                            PID:13012
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                              attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\endi6vin\x8cvdnul.exe"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                              PID:13072
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\endi6vin\x8cvdnul.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\endi6vin\x8cvdnul.exe
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:13232
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\endi6vin\x8cvdnul.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\endi6vin\x8cvdnul.exe
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:13308
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kchqplae\wb0ziwna.exe"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8692
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                    attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kchqplae\wb0ziwna.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:12496
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kchqplae\wb0ziwna.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kchqplae\wb0ziwna.exe
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:12656
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kchqplae\wb0ziwna.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\kchqplae\wb0ziwna.exe
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:12796
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oq8i7rms\vocm0i4e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:12760
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\attrib.exe
                                                                                                                                                                                                                                                                                                                                                                                                            attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\oq8i7rms\vocm0i4e.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                                                                                                                                                                                                                                                            PID:12848

                                                                                                                                                                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                          VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\VCRUNTIME140.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 94KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_bz2.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 84KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 cb2b8853ccf149b0b175769cb8ed6e2f9c2cbec0af3d8835c43570fd91da1b4f
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_decimal.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 265KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 5f8e850820050cabe5aa36838ba9abd62a4f5d5d2aa1b337cbb795077e1d48bf
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_hashlib.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 64KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 9a1ffa72a808fdfe88dd8f9e7083b285edf246df07c35ac032dc45d905f58fce
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_lzma.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 159KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 e352c77f7810ea83617ed096626ac9c3d628726def47551f90741d201c1f3b3d
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_socket.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 78KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 acb377fd6967b2ce819601c7d6a102d30af570eaee9e312e383f34aecd5df142
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_ssl.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 151KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 75ae15b70eaa1950cf259fed95ade499d7c6dfefffdf4c3292c46bd24da25902
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          _uuid.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\_uuid.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 e4cd5a2b7be54e858592f451b84280397aa8d6546906bc6834170a24a3857fae
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\base_library.zip
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 711KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 c517e98077423360b56176af9c686ddb9d70541ce66a5d9588eb210cf2bc06a5
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\libcrypto-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 3.3MB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\libssl-1_1.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 678KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          python39.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\python39.dll
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 4.3MB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 8314174dacfc1c4f177be8266c78f147621cf577a39742642a76ec27e7b87b02
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          select.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\select.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 2a451074afe05260fc274fba6851f8f96cd46ad32b657d876dd55f237244b6e3
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI45202\unicodedata.pyd
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 3efd2cfb8f29e914e002a244b2072ad9ed595abcb9179759020f3a10c9089204
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          9jy8wmi5.exe
                                                                                                                                                                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\5t11gz83\9jy8wmi5.exe
                                                                                                                                                                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                                                                                                                                                                          • SHA256 320efb1faa83c4c2cc637404802ff05a0a159f15d197ba925bae0afeec27cb0f
                                                                                                                                                                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                          memory/4628-447-0x0000017722B00000-0x0000017722BAD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                          memory/4628-446-0x0000017722AC0000-0x0000017722AE7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                          memory/4968-421-0x0000015A40210000-0x0000015A4022B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                                                                                                                                                                          memory/4968-422-0x0000015A40330000-0x0000015A40348000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                          Download