e6de0e82d69f1b9055c9ff32d2947a47c7b096ff7e7df1f2c4e19c96506aa794

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-en-20210920
submitted
21-10-2021 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bd9973bda5ff85a87c17d6db0b80d8a.exe
Size

38KB
MD5

8bd9973bda5ff85a87c17d6db0b80d8a
SHA1

89f991a718553a51aa17faf1d36c3da1fe4e77a5
SHA256

e6de0e82d69f1b9055c9ff32d2947a47c7b096ff7e7df1f2c4e19c96506aa794
SHA512

d96f878784d01579a3d786b1b77f87539cea94d80d5966d2c8723c930b665980380564a92ce2c8533da8bc7a07a00913cd680c0d2bd5c56d38f6a711cc1ce1c5

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\wntlock4.exe"	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8bd9973bda5ff85a87c17d6db0b80d8a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8bd9973bda5ff85a87c17d6db0b80d8a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8bd9973bda5ff85a87c17d6db0b80d8a.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1420 taskkill.exe
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

564 reg.exe
1796 reg.exe
1876 reg.exe
700 reg.exe
Runs net.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1420 taskkill.exe

pid	process
1420	taskkill.exe

pid	process
564	reg.exe
1796	reg.exe
1876	reg.exe
700	reg.exe

description	pid	process
Token: SeDebugPrivilege	1420	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8bd9973bda5ff85a87c17d6db0b80d8a.execmd.exenet.exenet.exenet.exe

description	pid	process	target process
PID 268 wrote to memory of 548	268	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 268 wrote to memory of 548	268	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 268 wrote to memory of 548	268	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 268 wrote to memory of 548	268	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 548 wrote to memory of 1612	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1612	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1612	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1612	548	cmd.exe	reg.exe
PID 548 wrote to memory of 564	548	cmd.exe	reg.exe
PID 548 wrote to memory of 564	548	cmd.exe	reg.exe
PID 548 wrote to memory of 564	548	cmd.exe	reg.exe
PID 548 wrote to memory of 564	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1796	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1796	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1796	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1796	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1876	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1876	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1876	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1876	548	cmd.exe	reg.exe
PID 548 wrote to memory of 700	548	cmd.exe	reg.exe
PID 548 wrote to memory of 700	548	cmd.exe	reg.exe
PID 548 wrote to memory of 700	548	cmd.exe	reg.exe
PID 548 wrote to memory of 700	548	cmd.exe	reg.exe
PID 548 wrote to memory of 1420	548	cmd.exe	taskkill.exe
PID 548 wrote to memory of 1420	548	cmd.exe	taskkill.exe
PID 548 wrote to memory of 1420	548	cmd.exe	taskkill.exe
PID 548 wrote to memory of 1420	548	cmd.exe	taskkill.exe
PID 548 wrote to memory of 1036	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1036	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1036	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1036	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1468	548	cmd.exe	net.exe
PID 548 wrote to memory of 1468	548	cmd.exe	net.exe
PID 548 wrote to memory of 1468	548	cmd.exe	net.exe
PID 548 wrote to memory of 1468	548	cmd.exe	net.exe
PID 1468 wrote to memory of 1160	1468	net.exe	net1.exe
PID 1468 wrote to memory of 1160	1468	net.exe	net1.exe
PID 1468 wrote to memory of 1160	1468	net.exe	net1.exe
PID 548 wrote to memory of 1000	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1000	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1000	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1000	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1012	548	cmd.exe	net.exe
PID 548 wrote to memory of 1012	548	cmd.exe	net.exe
PID 548 wrote to memory of 1012	548	cmd.exe	net.exe
PID 548 wrote to memory of 1012	548	cmd.exe	net.exe
PID 1012 wrote to memory of 1352	1012	net.exe	net1.exe
PID 1012 wrote to memory of 1352	1012	net.exe	net1.exe
PID 1012 wrote to memory of 1352	1012	net.exe	net1.exe
PID 548 wrote to memory of 1404	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1404	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1404	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1404	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 840	548	cmd.exe	net.exe
PID 548 wrote to memory of 840	548	cmd.exe	net.exe
PID 548 wrote to memory of 840	548	cmd.exe	net.exe
PID 548 wrote to memory of 840	548	cmd.exe	net.exe
PID 840 wrote to memory of 772	840	net.exe	net1.exe
PID 840 wrote to memory of 772	840	net.exe	net1.exe
PID 840 wrote to memory of 772	840	net.exe	net1.exe
PID 548 wrote to memory of 1992	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1992	548	cmd.exe	rundll32.exe
PID 548 wrote to memory of 1992	548	cmd.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\8bd9973bda5ff85a87c17d6db0b80d8a.exe
"C:\Users\Admin\AppData\Local\Temp\8bd9973bda5ff85a87c17d6db0b80d8a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\cmd.exe
cmd /c wntlock.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:548

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d C:\Users\Admin\Downloads\wntlock4.exe /f
3⤵
- Modifies WinLogon for persistence
PID:1612

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v shutdownwithoutlogon /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:564

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:1796

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:1876

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HidePowerOptions /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:700

C:\Windows\system32\taskkill.exe
taskkill /im explorer.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1036

C:\Windows\system32\net.exe
net user Admin 241671346
3⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 241671346
4⤵
PID:1160

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 3153020217
3⤵
- Suspicious use of WriteProcessMemory
PID:1012

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3153020217
4⤵
PID:1352

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1404

C:\Windows\system32\net.exe
net user Admin 51597992
3⤵
- Suspicious use of WriteProcessMemory
PID:840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 51597992
4⤵
PID:772

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 227586958
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 227586958
4⤵
PID:1760

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:112

C:\Windows\system32\net.exe
net user Admin 1806427950
3⤵
PID:916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1806427950
4⤵
PID:1368

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:972

C:\Windows\system32\net.exe
net user Admin 1656627369
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1656627369
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1108

C:\Windows\system32\net.exe
net user Admin 1974622129
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1974622129
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:700

C:\Windows\system32\net.exe
net user Admin 2950822650
3⤵
PID:1872

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2950822650
4⤵
PID:272

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 10221389
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10221389
4⤵
PID:628

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1164

C:\Windows\system32\net.exe
net user Admin 299173145
3⤵
PID:1960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 299173145
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:576

C:\Windows\system32\net.exe
net user Admin 460325968
3⤵
PID:652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 460325968
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1636

C:\Windows\system32\net.exe
net user Admin 925318622
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 925318622
4⤵
PID:1764

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1276

C:\Windows\system32\net.exe
net user Admin 2175111696
3⤵
PID:1740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2175111696
4⤵
PID:992

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 1050527999
3⤵
PID:1372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1050527999
4⤵
PID:1728

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:608

C:\Windows\system32\net.exe
net user Admin 267317568
3⤵
PID:1108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 267317568
4⤵
PID:1124

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1648

C:\Windows\system32\net.exe
net user Admin 2047013624
3⤵
PID:700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2047013624
4⤵
PID:1420

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1064

C:\Windows\system32\net.exe
net user Admin 3129819999
3⤵
PID:1448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3129819999
4⤵
PID:1160

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1884

C:\Windows\system32\net.exe
net user Admin 954413440
3⤵
PID:1712

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 954413440
4⤵
PID:944

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:576

C:\Windows\system32\net.exe
net user Admin 2506815585
3⤵
PID:840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2506815585
4⤵
PID:2020

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1636

C:\Windows\system32\net.exe
net user Admin 2586222905
3⤵
PID:1964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2586222905
4⤵
PID:1944

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:112

C:\Windows\system32\net.exe
net user Admin 1169429651
3⤵
PID:1276

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1169429651
4⤵
PID:1052

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:992

C:\Windows\system32\net.exe
net user Admin 481229848
3⤵
PID:1740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 481229848
4⤵
PID:1716

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1592

C:\Windows\system32\net.exe
net user Admin 671629353
3⤵
PID:1732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 671629353
4⤵
PID:1068

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1876

C:\Windows\system32\net.exe
net user Admin 199763046
3⤵
PID:984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 199763046
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1648

C:\Windows\system32\net.exe
net user Admin 1037715706
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1037715706
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:700

C:\Windows\system32\net.exe
net user Admin 1392932166
3⤵
PID:1264

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1392932166
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1476

C:\Windows\system32\net.exe
net user Admin 1788613278
3⤵
PID:1468

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1788613278
4⤵
PID:1708

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:784

C:\Windows\system32\net.exe
net user Admin 2984513880
3⤵
PID:1960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2984513880
4⤵
PID:944

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:988

C:\Windows\system32\net.exe
net user Admin 148905942
3⤵
PID:2032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 148905942
4⤵
PID:652

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1636

C:\Windows\system32\net.exe
net user Admin 1513132061
3⤵
PID:1956

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1513132061
4⤵
PID:1760

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:112

C:\Windows\system32\net.exe
net user Admin 2063324494
3⤵
PID:916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2063324494
4⤵
PID:1868

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:992

C:\Windows\system32\net.exe
net user Admin 214167676
3⤵
PID:1756

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 214167676
4⤵
PID:1600

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:608

C:\Windows\system32\net.exe
net user Admin 2826318527
3⤵
PID:564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2826318527
4⤵
PID:1068

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1632

C:\Windows\system32\net.exe
net user Admin 319728421
3⤵
PID:1796

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 319728421
4⤵
PID:636

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1556

C:\Windows\system32\net.exe
net user Admin 306313303
3⤵
PID:272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 306313303
4⤵
PID:1036

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:628

C:\Windows\system32\net.exe
net user Admin 668832019
3⤵
PID:1000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 668832019
4⤵
PID:1064

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 1743920157
3⤵
PID:1448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1743920157
4⤵
PID:1352

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1128

C:\Windows\system32\net.exe
net user Admin 1672223863
3⤵
PID:1440

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1672223863
4⤵
PID:484

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 281024559
3⤵
PID:1992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 281024559
4⤵
PID:1824

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1596

C:\Windows\system32\net.exe
net user Admin 2387427187
3⤵
PID:1764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2387427187
4⤵
PID:1368

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1276

C:\Windows\system32\net.exe
net user Admin 296182990
3⤵
PID:912

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 296182990
4⤵
PID:1744

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:972

C:\Windows\system32\net.exe
net user Admin 563228964
3⤵
PID:876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 563228964
4⤵
PID:1372

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1732

C:\Windows\system32\net.exe
net user Admin 242194605
3⤵
PID:1612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 242194605
4⤵
PID:1108

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1576

C:\Windows\system32\net.exe
net user Admin 233484453
3⤵
PID:1840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 233484453
4⤵
PID:1168

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1820

C:\Windows\system32\net.exe
net user Admin 1779616518
3⤵
PID:1420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1779616518
4⤵
PID:1616

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1792

C:\Windows\system32\net.exe
net user Admin 3048021423
3⤵
PID:1660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3048021423
4⤵
PID:1164

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1400

C:\Windows\system32\net.exe
net user Admin 621927006
3⤵
PID:1708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 621927006
4⤵
PID:1012

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1468

C:\Windows\system32\net.exe
net user Admin 1984315493
3⤵
PID:944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1984315493
4⤵
PID:2020

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1960

C:\Windows\system32\net.exe
net user Admin 3084623306
3⤵
PID:652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3084623306
4⤵
PID:1964

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2032

C:\Windows\system32\net.exe
net user Admin 708824015
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 708824015
4⤵
PID:1052

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1956

C:\Windows\system32\net.exe
net user Admin 52327682
3⤵
PID:1868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 52327682
4⤵
PID:1740

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:916

C:\Windows\system32\net.exe
net user Admin 1935811205
3⤵
PID:1600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1935811205
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 144764596
3⤵
PID:1068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 144764596
4⤵
PID:1580

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:564

C:\Windows\system32\net.exe
net user Admin 123376414
3⤵
PID:1724

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 123376414
4⤵
PID:1564

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1032

C:\Windows\system32\net.exe
net user Admin 27942668
3⤵
PID:1796

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 27942668
4⤵
PID:1036

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1556

C:\Windows\system32\net.exe
net user Admin 1570515913
3⤵
PID:272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1570515913
4⤵
PID:1064

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:628

C:\Windows\system32\net.exe
net user Admin 950420850
3⤵
PID:1000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 950420850
4⤵
PID:1352

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 42334109
3⤵
PID:1448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 42334109
4⤵
PID:484

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1128

C:\Windows\system32\net.exe
net user Admin 9113141
3⤵
PID:1440

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 9113141
4⤵
PID:1824

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 2391527148
3⤵
PID:1992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2391527148
4⤵
PID:1368

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1596

C:\Windows\system32\net.exe
net user Admin 2654230631
3⤵
PID:1764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2654230631
4⤵
PID:1744

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1276

C:\Windows\system32\net.exe
net user Admin 481828413
3⤵
PID:912

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 481828413
4⤵
PID:1372

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:972

C:\Windows\system32\net.exe
net user Admin 2576927529
3⤵
PID:876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2576927529
4⤵
PID:1108

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1732

C:\Windows\system32\net.exe
net user Admin 194401434
3⤵
PID:1612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 194401434
4⤵
PID:1168

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1576

C:\Windows\system32\net.exe
net user Admin 2308624873
3⤵
PID:1840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2308624873
4⤵
PID:1616

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1820

C:\Windows\system32\net.exe
net user Admin 2503329735
3⤵
PID:1420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2503329735
4⤵
PID:1164

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1792

C:\Windows\system32\net.exe
net user Admin 1676818568
3⤵
PID:1660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1676818568
4⤵
PID:1012

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1400

C:\Windows\system32\net.exe
net user Admin 1251924405
3⤵
PID:1708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1251924405
4⤵
PID:2020

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1468

C:\Windows\system32\net.exe
net user Admin 1577317793
3⤵
PID:944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1577317793
4⤵
PID:1964

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1960

C:\Windows\system32\net.exe
net user Admin 2644712389
3⤵
PID:652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2644712389
4⤵
PID:1052

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2032

C:\Windows\system32\net.exe
net user Admin 3092626375
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3092626375
4⤵
PID:1740

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1956

C:\Windows\system32\net.exe
net user Admin 283419872
3⤵
PID:1868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 283419872
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:916

C:\Windows\system32\net.exe
net user Admin 12425518
3⤵
PID:1600

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 12425518
4⤵
PID:1580

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 181566055
3⤵
PID:1068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 181566055
4⤵
PID:1564

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:564

C:\Windows\system32\net.exe
net user Admin 493332620
3⤵
PID:1724

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 493332620
4⤵
PID:1036

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1032

C:\Windows\system32\net.exe
net user Admin 257609207
3⤵
PID:1796

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 257609207
4⤵
PID:1064

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1556

C:\Windows\system32\net.exe
net user Admin 545532417
3⤵
PID:272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 545532417
4⤵
PID:1352

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:628

C:\Windows\system32\net.exe
net user Admin 2669524943
3⤵
PID:1000

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2669524943
4⤵
PID:484

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 790019030
3⤵
PID:1448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 790019030
4⤵
PID:1824

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1128

C:\Windows\system32\net.exe
net user Admin 1672516901
3⤵
PID:1440

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1672516901
4⤵
PID:1368

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 2281510690
3⤵
PID:1992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2281510690
4⤵
PID:1744

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1596

C:\Windows\system32\net.exe
net user Admin 452714677
3⤵
PID:1764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 452714677
4⤵
PID:1372

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1276

C:\Windows\system32\net.exe
net user Admin 750313587
3⤵
PID:912

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 750313587
4⤵
PID:1108

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:972

C:\Windows\system32\net.exe
net user Admin 2595525995
3⤵
PID:876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2595525995
4⤵
PID:1168

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1732

C:\Windows\system32\net.exe
net user Admin 255325963
3⤵
PID:1612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 255325963
4⤵
PID:1616

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1576

C:\Windows\system32\net.exe
net user Admin 475816260
3⤵
PID:1840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 475816260
4⤵
PID:1164

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1820

C:\Windows\system32\net.exe
net user Admin 66626152
3⤵
PID:1420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 66626152
4⤵
PID:1012

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1792

C:\Windows\system32\net.exe
net user Admin 219505680
3⤵
PID:1660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 219505680
4⤵
PID:2020

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1400

C:\Windows\system32\net.exe
net user Admin 198212920
3⤵
PID:1708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 198212920
4⤵
PID:1964

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1468

C:\Windows\system32\net.exe
net user Admin 3227322843
3⤵
PID:944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3227322843
4⤵
PID:1052

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1960

C:\Windows\system32\net.exe
net user Admin 172824556
3⤵
PID:652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 172824556
4⤵
PID:1740

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2032

C:\Windows\system32\net.exe
net user Admin 1593230444
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1593230444
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1868

C:\Windows\system32\net.exe
net user Admin 181922941
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 181922941
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1600

C:\Windows\system32\net.exe
net user Admin 3004120813
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3004120813
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1068

C:\Windows\system32\net.exe
net user Admin 297087789
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 297087789
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1724

C:\Windows\system32\net.exe
net user Admin 10513724
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10513724
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1796

C:\Windows\system32\net.exe
net user Admin 1612230688
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1612230688
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:272

C:\Windows\system32\net.exe
net user Admin 58818593
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 58818593
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 302126442
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 302126442
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1448

C:\Windows\system32\net.exe
net user Admin 2674624625
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2674624625
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1440

C:\Windows\system32\net.exe
net user Admin 2260125018
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2260125018
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 49330386
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 49330386
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\system32\net.exe
net user Admin 1419931319
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1419931319
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1924

C:\Windows\system32\net.exe
net user Admin 1506821457
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1506821457
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\system32\net.exe
net user Admin 224281450
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 224281450
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1108

C:\Windows\system32\net.exe
net user Admin 790414864
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 790414864
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1168

C:\Windows\system32\net.exe
net user Admin 31314845
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 31314845
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:564

C:\Windows\system32\net.exe
net user Admin 708028340
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 708028340
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1032

C:\Windows\system32\net.exe
net user Admin 3112918498
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3112918498
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 2353530942
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2353530942
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2020

C:\Windows\system32\net.exe
net user Admin 2185613399
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2185613399
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1964

C:\Windows\system32\net.exe
net user Admin 2013923544
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2013923544
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1052

C:\Windows\system32\net.exe
net user Admin 22887648
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 22887648
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\system32\net.exe
net user Admin 1191120818
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1191120818
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1340

C:\Windows\system32\net.exe
net user Admin 2400724150
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2400724150
4⤵
PID:960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1856

C:\Windows\system32\net.exe
net user Admin 757217677
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 757217677
4⤵
PID:1328

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1764

C:\Windows\system32\net.exe
net user Admin 264207798
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 264207798
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:912

C:\Windows\system32\net.exe
net user Admin 105556713
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 105556713
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:876

C:\Windows\system32\net.exe
net user Admin 2727718973
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2727718973
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1612

C:\Windows\system32\net.exe
net user Admin 1906331290
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1906331290
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1164

C:\Windows\system32\net.exe
net user Admin 28336891
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 28336891
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1420

C:\Windows\system32\net.exe
net user Admin 1388913168
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1388913168
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:772

C:\Windows\system32\net.exe
net user Admin 14731621
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 14731621
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 468327415
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 468327415
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:944

C:\Windows\system32\net.exe
net user Admin 1166521240
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1166521240
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:652

C:\Windows\system32\net.exe
net user Admin 250729835
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 250729835
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1496

C:\Windows\system32\net.exe
net user Admin 307213227
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 307213227
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 1623528432
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1623528432
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1120

C:\Windows\system32\net.exe
net user Admin 3124529892
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3124529892
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:916

C:\Windows\system32\net.exe
net user Admin 136405810
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 136405810
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1600

C:\Windows\system32\net.exe
net user Admin 109468733
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 109468733
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:700

C:\Windows\system32\net.exe
net user Admin 1948124041
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1948124041
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 3107529608
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3107529608
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1556

C:\Windows\system32\net.exe
net user Admin 8298607
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 8298607
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 1305912289
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1305912289
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 536730772
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 536730772
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1448

C:\Windows\system32\net.exe
net user Admin 2619410724
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2619410724
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 2998021153
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2998021153
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 147763566
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 147763566
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1864

C:\Windows\system32\net.exe
net user Admin 70528156
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 70528156
4⤵
PID:960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1924

C:\Windows\system32\net.exe
net user Admin 2652815784
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2652815784
4⤵
PID:1328

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1572

C:\Windows\system32\net.exe
net user Admin 2899815420
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2899815420
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 2178323489
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2178323489
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1616

C:\Windows\system32\net.exe
net user Admin 2272524734
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2272524734
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:564

C:\Windows\system32\net.exe
net user Admin 3035728059
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3035728059
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1296

C:\Windows\system32\net.exe
net user Admin 2290328679
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2290328679
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:628

C:\Windows\system32\net.exe
net user Admin 3049013834
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3049013834
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1944

C:\Windows\system32\net.exe
net user Admin 804918571
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 804918571
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1128

C:\Windows\system32\net.exe
net user Admin 2188511608
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2188511608
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1716

C:\Windows\system32\net.exe
net user Admin 90577021
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 90577021
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1360

C:\Windows\system32\net.exe
net user Admin 2764914988
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2764914988
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1844

C:\Windows\system32\net.exe
net user Admin 37804231
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 37804231
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:608

C:\Windows\system32\net.exe
net user Admin 56744587
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 56744587
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1868

C:\Windows\system32\net.exe
net user Admin 1237714572
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1237714572
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:636

C:\Windows\system32\net.exe
net user Admin 2683123744
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2683123744
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1068

C:\Windows\system32\net.exe
net user Admin 53335325
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 53335325
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1724

C:\Windows\system32\net.exe
net user Admin 123993673
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 123993673
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1796

C:\Windows\system32\net.exe
net user Admin 610412441
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 610412441
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:272

C:\Windows\system32\net.exe
net user Admin 106972642
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 106972642
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 2887528
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2887528
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1964

C:\Windows\system32\net.exe
net user Admin 1040622
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1040622
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1440

C:\Windows\system32\net.exe
net user Admin 50918586
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 50918586
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\system32\net.exe
net user Admin 84428098
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 84428098
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\system32\net.exe
net user Admin 998830395
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 998830395
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1856

C:\Windows\system32\net.exe
net user Admin 179632956
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 179632956
4⤵
PID:960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\system32\net.exe
net user Admin 461626026
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 461626026
4⤵
PID:1328

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:912

C:\Windows\system32\net.exe
net user Admin 1348911332
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1348911332
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1168

C:\Windows\system32\net.exe
net user Admin 416623035
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 416623035
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1612

C:\Windows\system32\net.exe
net user Admin 2300718587
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2300718587
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1032

C:\Windows\system32\net.exe
net user Admin 248007065
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 248007065
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1420

C:\Windows\system32\net.exe
net user Admin 35841921
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 35841921
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2020

C:\Windows\system32\net.exe
net user Admin 162699648
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 162699648
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 528616147
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 528616147
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1128

C:\Windows\system32\net.exe
net user Admin 19343530
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 19343530
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1484

C:\Windows\system32\net.exe
net user Admin 3052713525
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3052713525
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1340

C:\Windows\system32\net.exe
net user Admin 74026168
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 74026168
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 2813713115
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2813713115
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1764

C:\Windows\system32\net.exe
net user Admin 147848115
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 147848115
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:916

C:\Windows\system32\net.exe
net user Admin 190806255
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 190806255
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:636

C:\Windows\system32\net.exe
net user Admin 2207511843
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2207511843
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:700

C:\Windows\system32\net.exe
net user Admin 667716974
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 667716974
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1164

C:\Windows\system32\net.exe
net user Admin 2874330048
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2874330048
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1556

C:\Windows\system32\net.exe
net user Admin 2872931667
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2872931667
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:772

C:\Windows\system32\net.exe
net user Admin 2198916215
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2198916215
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:956

C:\Windows\system32\net.exe
net user Admin 437820217
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 437820217
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:944

C:\Windows\system32\net.exe
net user Admin 911317392
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 911317392
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:652

C:\Windows\system32\net.exe
net user Admin 2802125019
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2802125019
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1496

C:\Windows\system32\net.exe
net user Admin 16667590
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 16667590
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1408

C:\Windows\system32\net.exe
net user Admin 945315838
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 945315838
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1120

C:\Windows\system32\net.exe
net user Admin 571229206
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 571229206
4⤵
PID:960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1108

C:\Windows\system32\net.exe
net user Admin 67411218
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 67411218
4⤵
PID:1328

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:912

C:\Windows\system32\net.exe
net user Admin 319220436
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 319220436
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1840

C:\Windows\system32\net.exe
net user Admin 10246532
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10246532
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 122012202
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 122012202
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1660

C:\Windows\system32\net.exe
net user Admin 230203576
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 230203576
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 11482282
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 11482282
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 918631141
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 918631141
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 2611829397
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2611829397
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 1785721345
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1785721345
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 1032613
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1032613
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1864

C:\Windows\system32\net.exe
net user Admin 80666671
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 80666671
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 147003897
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 147003897
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1572

C:\Windows\system32\net.exe
net user Admin 392329429
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 392329429
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 893711887
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 893711887
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1616

C:\Windows\system32\net.exe
net user Admin 3018627843
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3018627843
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:564

C:\Windows\system32\net.exe
net user Admin 158784039
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 158784039
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1296

C:\Windows\system32\net.exe
net user Admin 2178629649
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2178629649
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1556

C:\Windows\system32\net.exe
net user Admin 1235817156
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1235817156
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1944

C:\Windows\system32\net.exe
net user Admin 1552423465
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1552423465
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1052

C:\Windows\system32\net.exe
net user Admin 1398410902
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1398410902
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1716

C:\Windows\system32\net.exe
net user Admin 310558645
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 310558645
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1360

C:\Windows\system32\net.exe
net user Admin 2795229815
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2795229815
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1844

C:\Windows\system32\net.exe
net user Admin 1490719866
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1490719866
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:608

C:\Windows\system32\net.exe
net user Admin 161736739
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 161736739
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1868

C:\Windows\system32\net.exe
net user Admin 83064565
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 83064565
4⤵
PID:960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:876

C:\Windows\system32\net.exe
net user Admin 489111499
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 489111499
4⤵
PID:1328

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1068

C:\Windows\system32\net.exe
net user Admin 278404836
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 278404836
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1724

C:\Windows\system32\net.exe
net user Admin 185828347
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 185828347
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1796

C:\Windows\system32\net.exe
net user Admin 1632530392
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1632530392
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:272

C:\Windows\system32\net.exe
net user Admin 21086474
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 21086474
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 82648649
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 82648649
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 732011555
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 732011555
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1440

C:\Windows\system32\net.exe
net user Admin 1531017755
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1531017755
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\system32\net.exe
net user Admin 2578131890
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2578131890
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\system32\net.exe
net user Admin 54838960
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 54838960
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1856

C:\Windows\system32\net.exe
net user Admin 1780616624
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1780616624
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\system32\net.exe
net user Admin 584910591
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 584910591
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1600

C:\Windows\system32\net.exe
net user Admin 1222412979
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1222412979
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1168

C:\Windows\system32\net.exe
net user Admin 1427920019
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1427920019
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1612

C:\Windows\system32\net.exe
net user Admin 2755615392
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2755615392
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1032

C:\Windows\system32\net.exe
net user Admin 1214718839
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1214718839
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1420

C:\Windows\system32\net.exe
net user Admin 3059411954
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3059411954
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2020

C:\Windows\system32\net.exe
net user Admin 257235760
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 257235760
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1944

C:\Windows\system32\net.exe
net user Admin 563326559
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 563326559
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1052

C:\Windows\system32\net.exe
net user Admin 382523691
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 382523691
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1484

C:\Windows\system32\net.exe
net user Admin 841810329
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 841810329
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1340

C:\Windows\system32\net.exe
net user Admin 165579977
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 165579977
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1924

C:\Windows\system32\net.exe
net user Admin 296789331
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 296789331
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1764

C:\Windows\system32\net.exe
net user Admin 184073319
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 184073319
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1868

C:\Windows\system32\net.exe
net user Admin 10693396
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10693396
4⤵
PID:960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:636

C:\Windows\system32\net.exe
net user Admin 819712067
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 819712067
4⤵
PID:1328

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:700

C:\Windows\system32\net.exe
net user Admin 305536897
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 305536897
4⤵
PID:1548

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1164

C:\Windows\system32\net.exe
net user Admin 2577711853
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2577711853
4⤵
PID:1632

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:628

C:\Windows\system32\net.exe
net user Admin 2037022886
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2037022886
4⤵
PID:984

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:772

C:\Windows\system32\net.exe
net user Admin 3153532634
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3153532634
4⤵
PID:1668

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:956

C:\Windows\system32\net.exe
net user Admin 3259515492
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3259515492
4⤵
PID:1152

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:944

C:\Windows\system32\net.exe
net user Admin 2609316687
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2609316687
4⤵
PID:1748

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:652

C:\Windows\system32\net.exe
net user Admin 3114116258
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3114116258
4⤵
PID:1676

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1496

C:\Windows\system32\net.exe
net user Admin 3030030188
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3030030188
4⤵
PID:1316

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\system32\net.exe
net user Admin 47555005
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 47555005
4⤵
PID:112

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1120

C:\Windows\system32\net.exe
net user Admin 2073518422
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2073518422
4⤵
PID:1592

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1108

C:\Windows\system32\net.exe
net user Admin 173738626
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 173738626
4⤵
PID:1356

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:912

C:\Windows\system32\net.exe
net user Admin 3065814937
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3065814937
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1840

C:\Windows\system32\net.exe
net user Admin 1073725598
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1073725598
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 2010827438
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2010827438
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1660

C:\Windows\system32\net.exe
net user Admin 1973423012
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1973423012
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 1999119226
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1999119226
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1964

C:\Windows\system32\net.exe
net user Admin 27957134
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 27957134
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 2278428183
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2278428183
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 1332821079
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1332821079
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 2639422903
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2639422903
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1864

C:\Windows\system32\net.exe
net user Admin 128355065
3⤵
PID:1536

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 128355065
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 3149629478
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3149629478
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1572

C:\Windows\system32\net.exe
net user Admin 1892628195
3⤵
PID:968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1892628195
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 564330255
3⤵
PID:1476

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 564330255
4⤵
PID:1292

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1068

C:\Windows\system32\net.exe
net user Admin 199348045
3⤵
PID:1168

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 199348045
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1724

C:\Windows\system32\net.exe
net user Admin 77044225
3⤵
PID:1612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 77044225
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1796

C:\Windows\system32\net.exe
net user Admin 2168716814
3⤵
PID:1032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2168716814
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:272

C:\Windows\system32\net.exe
net user Admin 271823572
3⤵
PID:628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 271823572
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 1856728174
3⤵
PID:2020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1856728174
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 2685413447
3⤵
PID:1944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2685413447
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1440

C:\Windows\system32\net.exe
net user Admin 250496968
3⤵
PID:1052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 250496968
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\system32\net.exe
net user Admin 545213803
3⤵
PID:1484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 545213803
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1408

C:\Windows\system32\net.exe
net user Admin 2538615106
3⤵
PID:1340

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2538615106
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1856

C:\Windows\system32\net.exe
net user Admin 1175723110
3⤵
PID:1924

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1175723110
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\system32\net.exe
net user Admin 1040123376
3⤵
PID:1764

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1040123376
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1600

C:\Windows\system32\net.exe
net user Admin 2513718481
3⤵
PID:1868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2513718481
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1680

C:\Windows\system32\net.exe
net user Admin 2457020021
3⤵
PID:760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2457020021
4⤵
PID:1292

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1840

C:\Windows\system32\net.exe
net user Admin 271153586
3⤵
PID:1328

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 271153586
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 319407516
3⤵
PID:1548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 319407516
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1660

C:\Windows\system32\net.exe
net user Admin 1515120561
3⤵
PID:1632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1515120561
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 1556419623
3⤵
PID:984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1556419623
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1964

C:\Windows\system32\net.exe
net user Admin 2109216821
3⤵
PID:1668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2109216821
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 2069712309
3⤵
PID:1152

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2069712309
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 1653718383
3⤵
PID:1748

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1653718383
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 3215322761
3⤵
PID:1676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3215322761
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1864

C:\Windows\system32\net.exe
net user Admin 2972529066
3⤵
PID:1316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2972529066
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 1865224073
3⤵
PID:112

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1865224073
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1572

C:\Windows\system32\net.exe
net user Admin 284898864
3⤵
PID:1592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 284898864
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 1792932
3⤵
PID:1356

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1792932
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1068

C:\Windows\system32\net.exe
net user Admin 249936241
3⤵
PID:636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 249936241
4⤵
PID:1292

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1724

C:\Windows\system32\net.exe
net user Admin 237241559
3⤵
PID:700

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 237241559
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1796

C:\Windows\system32\net.exe
net user Admin 2230011184
3⤵
PID:1164

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2230011184
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:272

C:\Windows\system32\net.exe
net user Admin 22423090
3⤵
PID:1556

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 22423090
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 2911929774
3⤵
PID:772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2911929774
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 27021014
3⤵
PID:956

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 27021014
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1440

C:\Windows\system32\net.exe
net user Admin 2494412635
3⤵
PID:944

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2494412635
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\system32\net.exe
net user Admin 3078828802
3⤵
PID:652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3078828802
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1408

C:\Windows\system32\net.exe
net user Admin 35946937
3⤵
PID:1496

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 35946937
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1856

C:\Windows\system32\net.exe
net user Admin 656926799
3⤵
PID:1508

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 656926799
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\system32\net.exe
net user Admin 10157500
3⤵
PID:1120

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10157500
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1600

C:\Windows\system32\net.exe
net user Admin 692820184
3⤵
PID:1108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 692820184
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1680

C:\Windows\system32\net.exe
net user Admin 444024255
3⤵
PID:960

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 444024255
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1840

C:\Windows\system32\net.exe
net user Admin 27784798
3⤵
PID:784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 27784798
4⤵
PID:1292

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 2296914401
3⤵
PID:988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2296914401
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1660

C:\Windows\system32\net.exe
net user Admin 85325387
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 85325387
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 13891496
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 13891496
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1964

C:\Windows\system32\net.exe
net user Admin 2549914454
3⤵
PID:992

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2549914454
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 1344222524
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1344222524
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 20577422
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 20577422
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 554715503
3⤵
PID:1940

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 554715503
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1864

C:\Windows\system32\net.exe
net user Admin 2040611450
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2040611450
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 216814932
3⤵
PID:1580

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 216814932
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1572

C:\Windows\system32\net.exe
net user Admin 1566129767
3⤵
PID:1564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1566129767
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\system32\net.exe
net user Admin 136184150
3⤵
PID:1036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 136184150
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1068

C:\Windows\system32\net.exe
net user Admin 2984015172
3⤵
PID:1064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2984015172
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1724

C:\Windows\system32\net.exe
net user Admin 2049519050
3⤵
PID:1616

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2049519050
4⤵
PID:1292

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1796

C:\Windows\system32\net.exe
net user Admin 58423619
3⤵
PID:564

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 58423619
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:272

C:\Windows\system32\net.exe
net user Admin 966327823
3⤵
PID:1296

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 966327823
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1000

C:\Windows\system32\net.exe
net user Admin 698116193
3⤵
PID:1420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 698116193
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1780

C:\Windows\system32\net.exe
net user Admin 220824564
3⤵
PID:2020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 220824564
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1440

C:\Windows\system32\net.exe
net user Admin 2698832
3⤵
PID:1128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2698832
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\system32\net.exe
net user Admin 127969339
3⤵
PID:1052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 127969339
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1408

C:\Windows\system32\net.exe
net user Admin 1352511314
3⤵
PID:1360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1352511314
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1856

C:\Windows\system32\net.exe
net user Admin 279155406
3⤵
PID:1844

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 279155406
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\system32\net.exe
net user Admin 3244930522
3⤵
PID:608

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3244930522
4⤵
PID:1400

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1600

C:\Windows\system32\net.exe
net user Admin 738412623
3⤵
PID:916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 738412623
4⤵
PID:1468

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1680

C:\Windows\system32\net.exe
net user Admin 323530317
3⤵
PID:876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 323530317
4⤵
PID:1960

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1840

C:\Windows\system32\net.exe
net user Admin 1329268
3⤵
PID:912

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1329268
4⤵
PID:2032

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1264

C:\Windows\system32\net.exe
net user Admin 2776121823
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2776121823
4⤵
PID:1292

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1660

C:\Windows\system32\net.exe
net user Admin 2867818578
3⤵
PID:484

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2867818578
4⤵
PID:1920

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1012

C:\Windows\system32\net.exe
net user Admin 280719355
3⤵
PID:1824

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 280719355
4⤵
PID:1656

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1964

C:\Windows\system32\net.exe
net user Admin 282669017
3⤵
PID:1368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 282669017
4⤵
PID:1276

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\system32\net.exe
net user Admin 276126898
3⤵
PID:1744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 276126898
4⤵
PID:972

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:840

C:\Windows\system32\net.exe
net user Admin 2316316353
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2316316353
4⤵
PID:1732

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1992

C:\Windows\system32\net.exe
net user Admin 19166968
3⤵
PID:1688

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 19166968
4⤵
PID:1576

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1864

C:\Windows\system32\net.exe
net user Admin 2727615971
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2727615971
4⤵
PID:1820

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\system32\net.exe
net user Admin 642129515
3⤵
PID:1596

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 642129515
4⤵
PID:1792

C:\Windows\system32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1572

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:676

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wntlock.bat
MD5
fb965c3de86bc0beb16be50a7dd97c22

SHA1
e591e49e45f319d2b973d00e60563e5a7eae959d

SHA256
8a3591052957fbe8729c961de41556cb2c65849dffa55c1ea9d8cb457c42f4c6

SHA512
1f520da1fb5c6bc55f2e1849e5822c461d811399c424110b1893d1497e1f6fcc10435e253428c1f041826cf55373a7bd978fa9fde6402c4487c1a4933d687f0d

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/112-78-0x0000000000000000-mapping.dmp

Download
memory/272-90-0x0000000000000000-mapping.dmp

Download
memory/548-54-0x0000000000000000-mapping.dmp

Download
memory/564-57-0x0000000000000000-mapping.dmp

Download
memory/576-99-0x0000000000000000-mapping.dmp

Download
memory/576-126-0x0000000000000000-mapping.dmp

Download
memory/608-111-0x0000000000000000-mapping.dmp

Download
memory/628-93-0x0000000000000000-mapping.dmp

Download
memory/652-100-0x0000000000000000-mapping.dmp

Download
memory/676-85-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/676-64-0x000007FEFBFD1000-0x000007FEFBFD3000-memory.dmp

Filesize
8KB

Download
memory/700-88-0x0000000000000000-mapping.dmp

Download
memory/700-115-0x0000000000000000-mapping.dmp

Download
memory/700-60-0x0000000000000000-mapping.dmp

Download
memory/772-72-0x0000000000000000-mapping.dmp

Download
memory/840-127-0x0000000000000000-mapping.dmp

Download
memory/840-71-0x0000000000000000-mapping.dmp

Download
memory/916-79-0x0000000000000000-mapping.dmp

Download
memory/944-124-0x0000000000000000-mapping.dmp

Download
memory/972-81-0x0000000000000000-mapping.dmp

Download
memory/992-107-0x0000000000000000-mapping.dmp

Download
memory/1000-66-0x0000000000000000-mapping.dmp

Download
memory/1012-67-0x0000000000000000-mapping.dmp

Download
memory/1036-62-0x0000000000000000-mapping.dmp

Download
memory/1064-119-0x0000000000000000-mapping.dmp

Download
memory/1108-112-0x0000000000000000-mapping.dmp

Download
memory/1108-84-0x0000000000000000-mapping.dmp

Download
memory/1124-113-0x0000000000000000-mapping.dmp

Download
memory/1152-98-0x0000000000000000-mapping.dmp

Download
memory/1160-121-0x0000000000000000-mapping.dmp

Download
memory/1160-65-0x0000000000000000-mapping.dmp

Download
memory/1164-96-0x0000000000000000-mapping.dmp

Download
memory/1264-91-0x0000000000000000-mapping.dmp

Download
memory/1276-105-0x0000000000000000-mapping.dmp

Download
memory/1352-68-0x0000000000000000-mapping.dmp

Download
memory/1368-80-0x0000000000000000-mapping.dmp

Download
memory/1372-109-0x0000000000000000-mapping.dmp

Download
memory/1404-70-0x0000000000000000-mapping.dmp

Download
memory/1420-116-0x0000000000000000-mapping.dmp

Download
memory/1420-61-0x0000000000000000-mapping.dmp

Download
memory/1448-120-0x0000000000000000-mapping.dmp

Download
memory/1468-63-0x0000000000000000-mapping.dmp

Download
memory/1476-92-0x0000000000000000-mapping.dmp

Download
memory/1596-74-0x0000000000000000-mapping.dmp

Download
memory/1612-56-0x0000000000000000-mapping.dmp

Download
memory/1632-87-0x0000000000000000-mapping.dmp

Download
memory/1636-102-0x0000000000000000-mapping.dmp

Download
memory/1648-86-0x0000000000000000-mapping.dmp

Download
memory/1648-114-0x0000000000000000-mapping.dmp

Download
memory/1712-123-0x0000000000000000-mapping.dmp

Download
memory/1728-110-0x0000000000000000-mapping.dmp

Download
memory/1732-83-0x0000000000000000-mapping.dmp

Download
memory/1740-106-0x0000000000000000-mapping.dmp

Download
memory/1744-82-0x0000000000000000-mapping.dmp

Download
memory/1756-108-0x0000000000000000-mapping.dmp

Download
memory/1760-75-0x0000000000000000-mapping.dmp

Download
memory/1764-104-0x0000000000000000-mapping.dmp

Download
memory/1796-58-0x0000000000000000-mapping.dmp

Download
memory/1824-103-0x0000000000000000-mapping.dmp

Download
memory/1872-89-0x0000000000000000-mapping.dmp

Download
memory/1876-59-0x0000000000000000-mapping.dmp

Download
memory/1884-122-0x0000000000000000-mapping.dmp

Download
memory/1960-97-0x0000000000000000-mapping.dmp

Download
memory/1992-73-0x0000000000000000-mapping.dmp

Download
memory/2020-128-0x0000000000000000-mapping.dmp

Download
memory/2032-101-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads