darkcomet | e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

Analysis

max time kernel
62s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Size

700KB
MD5

bdf17ff679149c3b8149bb9a7f5b882c
SHA1

1778fc7682d99c896da7e27328901a64763df2a3
SHA256

e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c
SHA512

19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2
SSDEEP

12288:vbKlFwfZCvqTtABYhuQF0bFtNU9jPldHNnJ9Is7rG5C37TZHXxFnrxO+uNUqx:vb4wfZdTts8uQeuJR8d5uTrZA/x

Score

10^/10

darkcomet evasion persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 35 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe,C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe

Executes dropped EXE 64 IoCs

pid	Process
1760	wnlogon.exe
1576	wnlogon.exe
812	wnlogon.exe
1684	wnlogon.exe
1036	wnlogon.exe
968	wnlogon.exe
584	wnlogon.exe
1744	wnlogon.exe
1488	cmd.exe
1452	wnlogon.exe
996	wnlogon.exe
1676	wnlogon.exe
2060	wnlogon.exe
2156	wnlogon.exe
2296	wnlogon.exe
2400	wnlogon.exe
2528	wnlogon.exe
2620	wnlogon.exe
2756	wnlogon.exe
2844	wnlogon.exe
2968	wnlogon.exe
3052	wnlogon.exe
2112	wnlogon.exe
2272	wnlogon.exe
1556	wnlogon.exe
2560	wnlogon.exe
2660	wnlogon.exe
2656	wnlogon.exe
2932	wnlogon.exe
2384	wnlogon.exe
1716	wnlogon.exe
1176	wnlogon.exe
1356	wnlogon.exe
2572	wnlogon.exe
2960	wnlogon.exe
3068	wnlogon.exe
2184	wnlogon.exe
1460	wnlogon.exe
2564	wnlogon.exe
2288	wnlogon.exe
2664	wnlogon.exe
1480	wnlogon.exe
2500	wnlogon.exe
2640	wnlogon.exe
892	wnlogon.exe
2480	wnlogon.exe
3144	wnlogon.exe
3212	wnlogon.exe
3332	wnlogon.exe
3408	wnlogon.exe
3528	wnlogon.exe
3600	wnlogon.exe
3720	wnlogon.exe
3792	wnlogon.exe
3916	wnlogon.exe
3988	wnlogon.exe
3108	wnlogon.exe
3116	wnlogon.exe
1640	wnlogon.exe
1356	wnlogon.exe
3716	wnlogon.exe
2824	wnlogon.exe
3820	wnlogon.exe
2316	wnlogon.exe

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
516	attrib.exe
2488	attrib.exe
3516	attrib.exe
2176	attrib.exe
612	attrib.exe
1544	attrib.exe
2480	attrib.exe
3708	attrib.exe
3936	attrib.exe
3528	attrib.exe
1888	attrib.exe
1988	attrib.exe
2508	attrib.exe
3704	attrib.exe
2544	attrib.exe
936	attrib.exe
2272	attrib.exe
3136	attrib.exe
3712	attrib.exe
1480	attrib.exe
2404	attrib.exe
3324	attrib.exe
1748	attrib.exe
2480	attrib.exe
2500	attrib.exe
3244	attrib.exe
1652	attrib.exe
2964	attrib.exe
2708	attrib.exe
4088	attrib.exe
2516	attrib.exe
2136	attrib.exe
732	attrib.exe
932	attrib.exe
2212	attrib.exe
3128	attrib.exe
2628	attrib.exe
2744	attrib.exe
1176	attrib.exe
2884	attrib.exe
1808	attrib.exe
3316	attrib.exe
3896	attrib.exe
3364	attrib.exe
652	attrib.exe
1132	attrib.exe
2264	attrib.exe
1640	attrib.exe
2956	attrib.exe
3296	attrib.exe
520	attrib.exe
2640	attrib.exe
2664	attrib.exe
2960	attrib.exe
1572	attrib.exe
2952	attrib.exe
2024	attrib.exe
3628	attrib.exe
1704	attrib.exe
2148	attrib.exe
3904	attrib.exe
3656	attrib.exe
3248	attrib.exe
1132	attrib.exe

Loads dropped DLL 64 IoCs

pid	Process
976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
1576	wnlogon.exe
1576	wnlogon.exe
1684	wnlogon.exe
1684	wnlogon.exe
968	wnlogon.exe
968	wnlogon.exe
1744	wnlogon.exe
1744	wnlogon.exe
1452	wnlogon.exe
1452	wnlogon.exe
1676	wnlogon.exe
1676	wnlogon.exe
2156	wnlogon.exe
2156	wnlogon.exe
2400	wnlogon.exe
2400	wnlogon.exe
2620	wnlogon.exe
2620	wnlogon.exe
2844	wnlogon.exe
2844	wnlogon.exe
3052	wnlogon.exe
3052	wnlogon.exe
2272	wnlogon.exe
2272	wnlogon.exe
2560	wnlogon.exe
2560	wnlogon.exe
2656	wnlogon.exe
2656	wnlogon.exe
2384	wnlogon.exe
2384	wnlogon.exe
1176	wnlogon.exe
1176	wnlogon.exe
2572	wnlogon.exe
2572	wnlogon.exe
3068	wnlogon.exe
3068	wnlogon.exe
1460	wnlogon.exe
1460	wnlogon.exe
2288	wnlogon.exe
2288	wnlogon.exe
1480	wnlogon.exe
1480	wnlogon.exe
2640	wnlogon.exe
2640	wnlogon.exe
2480	wnlogon.exe
2480	wnlogon.exe
3212	wnlogon.exe
3212	wnlogon.exe
3408	wnlogon.exe
3408	wnlogon.exe
3600	wnlogon.exe
3600	wnlogon.exe
3792	wnlogon.exe
3792	wnlogon.exe
3988	wnlogon.exe
3988	wnlogon.exe
3116	wnlogon.exe
3116	wnlogon.exe
1356	wnlogon.exe
1356	wnlogon.exe
2824	wnlogon.exe
2824	wnlogon.exe

Adds Run key to start application 2 TTPs 35 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\system32\\etc\\wnlogon.exe"	wnlogon.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File created	C:\Windows\SysWOW64\etc\wnlogon.exe	wnlogon.exe
File opened for modification	C:\Windows\SysWOW64\etc	attrib.exe

Suspicious use of SetThreadContext 35 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1760 set thread context of 1576	1760	wnlogon.exe	38
PID 812 set thread context of 1684	812	wnlogon.exe	49
PID 1036 set thread context of 968	1036	wnlogon.exe	60
PID 584 set thread context of 1744	584	wnlogon.exe	71
PID 1488 set thread context of 1452	1488	cmd.exe	82
PID 996 set thread context of 1676	996	wnlogon.exe	93
PID 2060 set thread context of 2156	2060	wnlogon.exe	104
PID 2296 set thread context of 2400	2296	wnlogon.exe	115
PID 2528 set thread context of 2620	2528	wnlogon.exe	126
PID 2756 set thread context of 2844	2756	wnlogon.exe	137
PID 2968 set thread context of 3052	2968	wnlogon.exe	148
PID 2112 set thread context of 2272	2112	wnlogon.exe	159
PID 1556 set thread context of 2560	1556	wnlogon.exe	170
PID 2660 set thread context of 2656	2660	wnlogon.exe	181
PID 2932 set thread context of 2384	2932	wnlogon.exe	192
PID 1716 set thread context of 1176	1716	wnlogon.exe	203
PID 1356 set thread context of 2572	1356	wnlogon.exe	214
PID 2960 set thread context of 3068	2960	wnlogon.exe	225
PID 2184 set thread context of 1460	2184	wnlogon.exe	236
PID 2564 set thread context of 2288	2564	wnlogon.exe	247
PID 2664 set thread context of 1480	2664	wnlogon.exe	258
PID 2500 set thread context of 2640	2500	wnlogon.exe	269
PID 892 set thread context of 2480	892	wnlogon.exe	280
PID 3144 set thread context of 3212	3144	wnlogon.exe	291
PID 3332 set thread context of 3408	3332	wnlogon.exe	302
PID 3528 set thread context of 3600	3528	wnlogon.exe	313
PID 3720 set thread context of 3792	3720	wnlogon.exe	324
PID 3916 set thread context of 3988	3916	wnlogon.exe	335
PID 3108 set thread context of 3116	3108	wnlogon.exe	346
PID 1640 set thread context of 1356	1640	wnlogon.exe	357
PID 3716 set thread context of 2824	3716	wnlogon.exe	368
PID 3820 set thread context of 2316	3820	wnlogon.exe	379
PID 3360 set thread context of 3308	3360	wnlogon.exe	390
PID 3604 set thread context of 3768	3604	wnlogon.exe	401

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 35 IoCs

Remote System Discovery

T1018

pid	Process
3004	PING.EXE
3028	PING.EXE
3028	PING.EXE
2428	PING.EXE
3576	PING.EXE
1820	PING.EXE
2724	PING.EXE
2340	PING.EXE
3028	PING.EXE
3124	PING.EXE
2588	PING.EXE
932	PING.EXE
3380	PING.EXE
3964	PING.EXE
4048	PING.EXE
3200	PING.EXE
1396	PING.EXE
3192	PING.EXE
3460	PING.EXE
3228	PING.EXE
2128	PING.EXE
1544	PING.EXE
2364	PING.EXE
2024	PING.EXE
2000	PING.EXE
2816	PING.EXE
2184	PING.EXE
3748	PING.EXE
3724	PING.EXE
1000	PING.EXE
3004	PING.EXE
2024	PING.EXE
2664	PING.EXE
3768	PING.EXE
2468	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeSecurityPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeTakeOwnershipPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeLoadDriverPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeSystemProfilePrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeSystemtimePrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeProfSingleProcessPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeIncBasePriorityPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeCreatePagefilePrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeBackupPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeRestorePrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeShutdownPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeDebugPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeSystemEnvironmentPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeChangeNotifyPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeRemoteShutdownPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeUndockPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeManageVolumePrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeImpersonatePrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeCreateGlobalPrivilege	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: 33	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: 34	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: 35	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
Token: SeIncreaseQuotaPrivilege	1576	wnlogon.exe
Token: SeSecurityPrivilege	1576	wnlogon.exe
Token: SeTakeOwnershipPrivilege	1576	wnlogon.exe
Token: SeLoadDriverPrivilege	1576	wnlogon.exe
Token: SeSystemProfilePrivilege	1576	wnlogon.exe
Token: SeSystemtimePrivilege	1576	wnlogon.exe
Token: SeProfSingleProcessPrivilege	1576	wnlogon.exe
Token: SeIncBasePriorityPrivilege	1576	wnlogon.exe
Token: SeCreatePagefilePrivilege	1576	wnlogon.exe
Token: SeBackupPrivilege	1576	wnlogon.exe
Token: SeRestorePrivilege	1576	wnlogon.exe
Token: SeShutdownPrivilege	1576	wnlogon.exe
Token: SeDebugPrivilege	1576	wnlogon.exe
Token: SeSystemEnvironmentPrivilege	1576	wnlogon.exe
Token: SeChangeNotifyPrivilege	1576	wnlogon.exe
Token: SeRemoteShutdownPrivilege	1576	wnlogon.exe
Token: SeUndockPrivilege	1576	wnlogon.exe
Token: SeManageVolumePrivilege	1576	wnlogon.exe
Token: SeImpersonatePrivilege	1576	wnlogon.exe
Token: SeCreateGlobalPrivilege	1576	wnlogon.exe
Token: 33	1576	wnlogon.exe
Token: 34	1576	wnlogon.exe
Token: 35	1576	wnlogon.exe
Token: SeIncreaseQuotaPrivilege	1684	wnlogon.exe
Token: SeSecurityPrivilege	1684	wnlogon.exe
Token: SeTakeOwnershipPrivilege	1684	wnlogon.exe
Token: SeLoadDriverPrivilege	1684	wnlogon.exe
Token: SeSystemProfilePrivilege	1684	wnlogon.exe
Token: SeSystemtimePrivilege	1684	wnlogon.exe
Token: SeProfSingleProcessPrivilege	1684	wnlogon.exe
Token: SeIncBasePriorityPrivilege	1684	wnlogon.exe
Token: SeCreatePagefilePrivilege	1684	wnlogon.exe
Token: SeBackupPrivilege	1684	wnlogon.exe
Token: SeRestorePrivilege	1684	wnlogon.exe
Token: SeShutdownPrivilege	1684	wnlogon.exe
Token: SeDebugPrivilege	1684	wnlogon.exe
Token: SeSystemEnvironmentPrivilege	1684	wnlogon.exe
Token: SeChangeNotifyPrivilege	1684	wnlogon.exe
Token: SeRemoteShutdownPrivilege	1684	wnlogon.exe
Token: SeUndockPrivilege	1684	wnlogon.exe
Token: SeManageVolumePrivilege	1684	wnlogon.exe

Suspicious use of SetWindowsHookEx 35 IoCs

pid	Process
1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
1760	wnlogon.exe
812	wnlogon.exe
1036	wnlogon.exe
584	wnlogon.exe
1488	cmd.exe
996	wnlogon.exe
2060	wnlogon.exe
2296	wnlogon.exe
2528	wnlogon.exe
2756	wnlogon.exe
2968	wnlogon.exe
2112	wnlogon.exe
1556	wnlogon.exe
2660	wnlogon.exe
2932	wnlogon.exe
1716	wnlogon.exe
1356	wnlogon.exe
2960	wnlogon.exe
2184	wnlogon.exe
2564	wnlogon.exe
2664	wnlogon.exe
2500	wnlogon.exe
892	wnlogon.exe
3144	wnlogon.exe
3332	wnlogon.exe
3528	wnlogon.exe
3720	wnlogon.exe
3916	wnlogon.exe
3108	wnlogon.exe
1640	wnlogon.exe
3716	wnlogon.exe
3820	wnlogon.exe
3360	wnlogon.exe
3604	wnlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 1104 wrote to memory of 976	1104	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	27
PID 976 wrote to memory of 1608	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	28
PID 976 wrote to memory of 1608	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	28
PID 976 wrote to memory of 1608	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	28
PID 976 wrote to memory of 1608	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	28
PID 976 wrote to memory of 1088	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	30
PID 976 wrote to memory of 1088	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	30
PID 976 wrote to memory of 1088	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	30
PID 976 wrote to memory of 1088	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	30
PID 1608 wrote to memory of 1652	1608	cmd.exe	32
PID 1608 wrote to memory of 1652	1608	cmd.exe	32
PID 1608 wrote to memory of 1652	1608	cmd.exe	32
PID 1608 wrote to memory of 1652	1608	cmd.exe	32
PID 1088 wrote to memory of 520	1088	cmd.exe	33
PID 1088 wrote to memory of 520	1088	cmd.exe	33
PID 1088 wrote to memory of 520	1088	cmd.exe	33
PID 1088 wrote to memory of 520	1088	cmd.exe	33
PID 976 wrote to memory of 1760	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	34
PID 976 wrote to memory of 1760	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	34
PID 976 wrote to memory of 1760	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	34
PID 976 wrote to memory of 1760	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	34
PID 976 wrote to memory of 1352	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	35
PID 976 wrote to memory of 1352	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	35
PID 976 wrote to memory of 1352	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	35
PID 976 wrote to memory of 1352	976	e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe	35
PID 1352 wrote to memory of 1000	1352	cmd.exe	37
PID 1352 wrote to memory of 1000	1352	cmd.exe	37
PID 1352 wrote to memory of 1000	1352	cmd.exe	37
PID 1352 wrote to memory of 1000	1352	cmd.exe	37
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1760 wrote to memory of 1576	1760	wnlogon.exe	38
PID 1576 wrote to memory of 288	1576	wnlogon.exe	39
PID 1576 wrote to memory of 288	1576	wnlogon.exe	39
PID 1576 wrote to memory of 288	1576	wnlogon.exe	39
PID 1576 wrote to memory of 288	1576	wnlogon.exe	39
PID 1576 wrote to memory of 1984	1576	wnlogon.exe	43
PID 1576 wrote to memory of 1984	1576	wnlogon.exe	43

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1652	attrib.exe
2640	attrib.exe
2964	attrib.exe
612	attrib.exe
2508	attrib.exe
2736	attrib.exe
1640	attrib.exe
2212	attrib.exe
1748	attrib.exe
2148	attrib.exe
3488	attrib.exe
3712	attrib.exe
3528	attrib.exe
2544	attrib.exe
3948	attrib.exe
2272	attrib.exe
2404	attrib.exe
3896	attrib.exe
1888	attrib.exe
2628	attrib.exe
2500	attrib.exe
3316	attrib.exe
3364	attrib.exe
2516	attrib.exe
2960	attrib.exe
2396	attrib.exe
1808	attrib.exe
3136	attrib.exe
652	attrib.exe
1132	attrib.exe
3244	attrib.exe
3708	attrib.exe
1544	attrib.exe
2264	attrib.exe
2884	attrib.exe
2956	attrib.exe
2876	attrib.exe
3128	attrib.exe
4088	attrib.exe
1704	attrib.exe
516	attrib.exe
3324	attrib.exe
3704	attrib.exe
3656	attrib.exe
3296	attrib.exe
3208	attrib.exe
520	attrib.exe
932	attrib.exe
2136	attrib.exe
2664	attrib.exe
3936	attrib.exe
1176	attrib.exe
2024	attrib.exe
2708	attrib.exe
3516	attrib.exe
3248	attrib.exe
1480	attrib.exe
1572	attrib.exe
2744	attrib.exe
2952	attrib.exe
1132	attrib.exe
2176	attrib.exe
2480	attrib.exe
1988	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
"C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe
  "C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:1652
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:520
- - C:\Windows\SysWOW64\etc\wnlogon.exe
    "C:\Windows\system32\etc\wnlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\SysWOW64\etc\wnlogon.exe
      "C:\Windows\SysWOW64\etc\wnlogon.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        5⤵
        
        PID:288
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        6⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1748
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        5⤵
        
        PID:1984
    - - C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:812
      - C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        6⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        7⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        7⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        8⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        7⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        8⤵
        Runs ping.exe
        
        PID:1820
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1036
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        8⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:968
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        9⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        9⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        10⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        9⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        10⤵
        Runs ping.exe
        
        PID:2024
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:584
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        10⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        11⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:612
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        13⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        11⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        12⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        11⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        12⤵
        Runs ping.exe
        
        PID:1396
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        11⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        12⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        13⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        14⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:996
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        14⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        15⤵
        
        PID:860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        15⤵
        
        PID:364
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        16⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        15⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        16⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        17⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        17⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        18⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2272
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        18⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        19⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        20⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2508
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        19⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        20⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        19⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        20⤵
        Runs ping.exe
        
        PID:2588
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2528
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        20⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        21⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        22⤵
        Views/modifies file attributes
        
        PID:2736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        21⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        22⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2744
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2756
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        22⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2844
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        23⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        23⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        24⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2952
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2968
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        24⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        25⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        25⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        26⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2136
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2112
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        26⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2272
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        27⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        28⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        27⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        28⤵
        Views/modifies file attributes
        
        PID:2396
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1556
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        28⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2560
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        29⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        30⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        29⤵
        
        PID:604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        30⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2640
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        30⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        31⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        32⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        31⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        32⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        31⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        32⤵
        Runs ping.exe
        
        PID:3004
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        32⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        33⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        34⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        33⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        34⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1808
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1716
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        34⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        35⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        36⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        35⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        35⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        36⤵
        Runs ping.exe
        
        PID:2428
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1356
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        36⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        37⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        38⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        37⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        38⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        37⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        38⤵
        Runs ping.exe
        
        PID:3028
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        38⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        39⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        40⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        39⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        40⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2212
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        40⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        41⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        42⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        41⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        42⤵
        Views/modifies file attributes
        
        PID:2876
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2564
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        42⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        43⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        44⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        43⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        44⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:516
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2664
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        44⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:1480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        45⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        46⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        45⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        46⤵
        Sets file to hidden
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:2500
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        46⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        47⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        48⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2500
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        47⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        48⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2480
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:892
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        48⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        49⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        50⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        49⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        50⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3136
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3144
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        50⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        51⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        52⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        51⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        52⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3324
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3332
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        52⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        53⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        54⤵
        Views/modifies file attributes
        
        PID:3488
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        53⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        54⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3516
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3528
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        54⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        55⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        56⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        55⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        56⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3712
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3720
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        56⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        57⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        58⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        57⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        58⤵
        Sets file to hidden
        
        PID:3904
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3916
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        58⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        59⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        60⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        59⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        60⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:4088
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        60⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        61⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        62⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3244
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        61⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        62⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3364
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:1640
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        62⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        63⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        64⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        63⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        64⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        63⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        64⤵
        Runs ping.exe
        
        PID:3748
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3716
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        64⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        65⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        66⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        65⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        66⤵
        Views/modifies file attributes
        
        PID:3948
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        65⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3820
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        66⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        67⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        68⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        67⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        68⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3248
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        67⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3360
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        68⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        
        PID:3308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        69⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        70⤵
        Sets file to hidden
        
        PID:3628
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        69⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        70⤵
        Sets file to hidden
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3528
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        69⤵
        Suspicious use of SetThreadContext
        Suspicious use of SetWindowsHookEx
        
        PID:3604
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\SysWOW64\etc\wnlogon.exe"
        70⤵
        Modifies WinLogon for persistence
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        71⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
        72⤵
        Drops file in System32 directory
        Views/modifies file attributes
        
        PID:3208
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        71⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\etc" +s +h
        72⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1888
        
        C:\Windows\SysWOW64\etc\wnlogon.exe
        
        "C:\Windows\system32\etc\wnlogon.exe"
        71⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        71⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        72⤵
        Runs ping.exe
        
        PID:3200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        69⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        70⤵
        Runs ping.exe
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        67⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        68⤵
        Runs ping.exe
        
        PID:3228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        65⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        66⤵
        Runs ping.exe
        
        PID:4048
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        61⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        62⤵
        Runs ping.exe
        
        PID:3460
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        59⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        60⤵
        Runs ping.exe
        
        PID:3124
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        57⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        58⤵
        Runs ping.exe
        
        PID:3964
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        55⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        56⤵
        Runs ping.exe
        
        PID:3768
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        53⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        54⤵
        Runs ping.exe
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        51⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        52⤵
        Runs ping.exe
        
        PID:3380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        49⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        50⤵
        Runs ping.exe
        
        PID:3192
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        47⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        48⤵
        Runs ping.exe
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        45⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        46⤵
        Runs ping.exe
        
        PID:2664
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        43⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        44⤵
        Runs ping.exe
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        41⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        42⤵
        Runs ping.exe
        
        PID:932
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        39⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        40⤵
        Runs ping.exe
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        33⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        34⤵
        Runs ping.exe
        
        PID:2340
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        29⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        30⤵
        Runs ping.exe
        
        PID:2724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        27⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        28⤵
        Runs ping.exe
        
        PID:2468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        25⤵
        
        PID:880
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        26⤵
        Runs ping.exe
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        23⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        24⤵
        Runs ping.exe
        
        PID:3028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        21⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        22⤵
        Runs ping.exe
        
        PID:2816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        17⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        18⤵
        Runs ping.exe
        
        PID:2364
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\etc" +s +h
        13⤵
        Drops file in System32 directory
        
        PID:612
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        12⤵
        Runs ping.exe
        
        PID:1544
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\SysWOW64\etc\wnlogon.exe"
        5⤵
        
        PID:1896
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 5
        6⤵
        Runs ping.exe
        
        PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      Runs ping.exe
      PID:1000

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\etc" +s +h
1⤵
- Sets file to hidden
PID:732

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 5
1⤵
- Runs ping.exe
PID:2128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\etc\wnlogon.exe" +s +h
1⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
C:\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
\Windows\SysWOW64\etc\wnlogon.exe

Filesize
700KB

MD5
bdf17ff679149c3b8149bb9a7f5b882c

SHA1
1778fc7682d99c896da7e27328901a64763df2a3

SHA256
e9cb5421c2efcd767017b35b8c5e50f279f467c4c7bde0b6a24a9d6d4465648c

SHA512
19d27751fe0e35891173eef586247f67de15b75b0a659e52609dc31c0e0e760f4ad5f3242ca867d1760bb42f3ef9911c1bc1289e412c7e491986a9d8208797a2

Download Submit
memory/968-133-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/976-65-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/976-60-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/976-59-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/976-56-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/976-58-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/976-71-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1176-307-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1356-408-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1452-164-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1452-173-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1460-330-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1460-328-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1480-344-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1576-81-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1576-93-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1576-82-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1676-192-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1684-277-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1684-101-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1684-114-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/1744-153-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2156-212-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2272-269-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2272-265-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2288-337-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2316-423-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2384-299-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2384-298-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2384-297-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2400-223-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2480-358-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2560-282-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2560-278-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2560-276-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2572-314-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2620-231-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2620-235-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2640-350-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2656-290-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2656-289-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2656-291-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2824-415-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2844-246-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3052-253-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3052-259-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3068-320-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3068-322-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3116-400-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3116-402-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3212-365-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3212-364-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3308-430-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3408-374-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3408-438-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3600-379-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3768-437-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3792-387-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/3988-393-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads