ad3bcb65313043b1a43b8fb210f3a20a87df8a8145ed9a18b086d0859616caa2

Analysis

max time kernel
163s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
Size

94KB
MD5

2ce9d15f7b43b0dec6c3935de0743113
SHA1

50cf913875f1447f894cf795a549df3c84f8f402
SHA256

d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91
SHA512

f06a98af22ecd806604f32a6b8584b918997b021ca1b91ab86dff9e3d9a7cdfb65aa8ab73edfd5cef5b98949cd6bd84a3925f3f1b5078b34bce7ee6c866ae42e
SSDEEP

1536:Ga/ySwKA8SE/+PN7A80iTubsESYPgFYtJEpTC2WbJCH7lkJJtn3gOt0:Ga/ySwK1SUYuXuYP8abNJtn3gOt0

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\D3E043~1.EXE"	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
"C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1012

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1040

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4104

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1080

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:860

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4396

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3940

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:764

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4132

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4832

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:412

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3816

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4288

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4964

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:5032

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4168

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4572

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:884

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3128

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1032

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4376

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4188

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4776

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4864

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:636

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3112

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3248

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:396

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2376

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3196

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2292

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:780

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2148

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4944

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4912

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1016

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4760

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3888

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4216

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4108

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3956

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3464

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4244

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3192

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3896

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3460

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2120

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1576

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3372

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1552

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4368

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4736

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3096

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2876

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:5004

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3944

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3024

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2248

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2644

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4400

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2364

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3816

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4288

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1836

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2792

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3812

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4572

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2520

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:404

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4860

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3728

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4260

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:3520

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:768

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:1020

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:228

C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
C:\Users\Admin\AppData\Local\Temp\d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
2⤵
PID:2408

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

description	pid	process	target process
PID 1012 wrote to memory of 1040	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1040	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1040	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2084	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2084	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2084	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 840	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 840	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 840	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4104	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4104	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4104	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2388	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2388	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2388	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1080	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1080	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1080	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4100	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4100	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4100	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4420	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4420	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4420	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 860	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 860	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 860	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1896	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1896	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1896	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4396	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4396	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4396	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2844	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2844	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2844	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3940	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3940	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3940	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 764	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 764	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 764	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3024	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3024	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3024	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2564	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2564	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2564	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2640	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2640	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 2640	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4460	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4460	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4460	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4132	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4132	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4132	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3084	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3084	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 3084	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1864	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1864	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 1864	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe
PID 1012 wrote to memory of 4832	1012	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe	d3e04348f412615e23ad0aebfee1b4338f5edf99776bdedf08fbb0462868ef91.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads