cf2cbad1f955dc1576733d0398c8eb6985d940a53237ba1bb0be1ac1f2ad6281

Analysis

max time kernel
32s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbf5bdb17cc3feccd573feab9655a7a5.exe
Size

187KB
MD5

cbf5bdb17cc3feccd573feab9655a7a5
SHA1

4c84a7476992912952ffa3f7438f919e4f8fe90b
SHA256

cf2cbad1f955dc1576733d0398c8eb6985d940a53237ba1bb0be1ac1f2ad6281
SHA512

20330a3601a979e3bf3d018de38b827f2d868e6c8642042cb875a9a0db39849ac255aa324976d2eebf16f7aedc3b843327f32044e78b265a273eb0862eabba88
SSDEEP

768:jeTDbPFalhisURRRVpRdNtAEaTtKmxFeMN1sDKZMbai8PK6LM5vjvVXS0gz41qjJ:jeHbPFcW3AEWgm3j1+uq6BN

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\ProgramData\\application data\\Microsoft\\KBDriver\\kbsys.exe\""	DirLock.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	DirLock.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	DirLock.exe

Executes dropped EXE 32 IoCs

pid	Process
2364	DirLock.exe
2664	2.exe
2592	winnthlp1.exe
2532	winnthlp2.exe
2492	lsass.exe
1144	2.exe
2216	winnthlp1.exe
2136	winnthlp2.exe
1788	2.exe
2188	winnthlp1.exe
608	winnthlp2.exe
1080	2.exe
2336	winnthlp1.exe
1800	winnthlp2.exe
2480	2.exe
2584	winnthlp1.exe
1692	winnthlp2.exe
1092	2.exe
2408	winnthlp1.exe
1548	winnthlp2.exe
1700	2.exe
2224	2.exe
2644	winnthlp1.exe
2944	winnthlp2.exe
1364	2.exe
2912	2.exe
2224	winnthlp1.exe
3024	winnthlp2.exe
2900	2.exe
2940	2.exe
1652	winnthlp1.exe
1732	winnthlp2.exe

Loads dropped DLL 62 IoCs

pid	Process
2100	cbf5bdb17cc3feccd573feab9655a7a5.exe
2100	cbf5bdb17cc3feccd573feab9655a7a5.exe
2364	DirLock.exe
2364	DirLock.exe
2664	2.exe
2664	2.exe
2664	2.exe
2664	2.exe
2492	lsass.exe
2492	lsass.exe
1144	2.exe
1144	2.exe
1144	2.exe
1144	2.exe
2364	DirLock.exe
2364	DirLock.exe
1788	2.exe
1788	2.exe
1788	2.exe
1788	2.exe
2364	DirLock.exe
2364	DirLock.exe
1080	2.exe
1080	2.exe
1080	2.exe
1080	2.exe
2492	lsass.exe
2492	lsass.exe
2480	2.exe
2480	2.exe
2480	2.exe
2480	2.exe
2492	lsass.exe
2492	lsass.exe
1092	2.exe
1092	2.exe
1092	2.exe
1092	2.exe
2492	lsass.exe
2492	lsass.exe
2364	DirLock.exe
2364	DirLock.exe
2224	2.exe
2224	2.exe
1700	2.exe
1700	2.exe
2364	DirLock.exe
2364	DirLock.exe
2492	lsass.exe
2492	lsass.exe
1364	2.exe
1364	2.exe
2912	2.exe
2912	2.exe
2364	DirLock.exe
2492	lsass.exe
2492	lsass.exe
2364	DirLock.exe
2940	2.exe
2940	2.exe
2900	2.exe
2900	2.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DirLock = "C:\\ProgramData\\application data\\Lambda\\DirLock.exe"	DirLock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LSAgent = "C:\\Windows\\lsass.exe"	DirLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system.exe"	DirLock.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	DirLock.exe
File created	C:\autorun.inf	DirLock.exe
File opened for modification	F:\autorun.inf	DirLock.exe
File created	F:\autorun.inf	DirLock.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\0407	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\ar-SA.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\da-DK.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\NDF	winnthlp2.exe
File created	C:\Windows\SysWOW64\spp.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Msdtc	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\catroot.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\com.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\hr-HR	winnthlp1.exe
File created	C:\Windows\SysWOW64\ko-KR.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\NDF	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\NetworkList.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\it-IT	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\sl-SI	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\slmgr	winnthlp1.exe
File created	C:\Windows\SysWOW64\sv-SE.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\en-US.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\winnthlp1.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\ar-SA.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\pt-PT.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp2.exe	2.exe
File opened for modification	C:\Windows\SysWOW64\pt-BR	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\sr-Latn-CS.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\DriverStore.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\es.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\Setup	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\restore	winnthlp1.exe
File created	C:\Windows\SysWOW64\Setup.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\IME	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\manifeststore.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\uk-UA.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\wdi.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\040C.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\com	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\ko-KR	winnthlp1.exe
File created	C:\Windows\SysWOW64\migration.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\oobe.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ras	winnthlp2.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\AdvancedInstallers	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\en-US.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\IME.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\sppui.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\drivers.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ja.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\lv-LV.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Msdtc.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\ro-RO.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\WCN.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Adobe AIR.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Defender.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Mail	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\MSBuild	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Portable Devices.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Google.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Mail.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Internet Explorer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\DESIGNER.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Google.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows NT.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Services.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\SpeechEngines	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Media Player.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows NT.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\DESIGNER	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Adobe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Reference Assemblies.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows NT	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Sidebar.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Google	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft Office.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Boot.exe	winnthlp2.exe
File created	C:\Windows\Web.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp2.exe
File opened for modification	C:\Windows\servicing	winnthlp2.exe
File opened for modification	C:\Windows\Boot	winnthlp1.exe
File opened for modification	C:\Windows\servicing	winnthlp1.exe
File created	C:\Windows\Boot.exe	winnthlp2.exe
File opened for modification	C:\Windows\Temp.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\diagnostics.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp2.exe
File opened for modification	C:\Windows\winsxs.exe	winnthlp2.exe
File created	C:\Windows\PCHEALTH.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\rescache	winnthlp2.exe
File opened for modification	C:\Windows\system.exe	winnthlp1.exe
File opened for modification	C:\Windows\CSC.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\ShellNew	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\tracing.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp1.exe
File opened for modification	C:\Windows\Registration.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Resources.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Setup	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe
File opened for modification	C:\Windows\Speech.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File opened for modification	C:\Windows\system.exe	winnthlp2.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp1.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File created	C:\Windows\CSC.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Prefetch	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\RemotePackages.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\rescache	winnthlp2.exe
File created	C:\Windows\System32.exe	winnthlp1.exe
File created	C:\Windows\addins.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\de-DE	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\servicing	winnthlp2.exe
File created	C:\Windows\Globalization.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Offline Web Pages	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp2.exe
File opened for modification	C:\Windows\L2Schemas	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\TAPI.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\diagnostics	winnthlp2.exe
File opened for modification	C:\Windows\Migration	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\twain_32.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\fr-FR.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\diagnostics	winnthlp2.exe
File created	C:\Windows\rescache.exe	winnthlp1.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp1.exe
File created	C:\Windows\Boot.exe	winnthlp2.exe
File opened for modification	C:\Windows\fr-FR	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\SysWOW64	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\rescache	winnthlp1.exe
File created	C:\Windows\it-IT.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\shutdown.dll	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\rescache	winnthlp2.exe
File created	C:\Windows\System32.exe	winnthlp1.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File opened for modification	C:\Windows\lsass.exe	winnthlp1.exe
File created	C:\Windows\servicing.exe	winnthlp2.exe
File opened for modification	C:\Windows\diagnostics	winnthlp1.exe
File opened for modification	C:\Windows\rescache.exe	winnthlp2.exe
File opened for modification	C:\Windows\diagnostics.exe	winnthlp2.exe
File opened for modification	C:\Windows\Globalization.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0 = 58003100000000006f581c89160057494e4e54487e310000400008000400efbe6f581c896f581c892a0000002ecb0100000005000000000000000000000000000000770069006e006e00740068006c0070003200000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000005558777b10204c6f63616c00380008000400efbe555873795558777b2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = 0000000001000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2056	vssvc.exe
Token: SeRestorePrivilege	2056	vssvc.exe
Token: SeAuditPrivilege	2056	vssvc.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
2100	cbf5bdb17cc3feccd573feab9655a7a5.exe
2364	DirLock.exe
2664	2.exe
2592	winnthlp1.exe
2532	winnthlp2.exe
2492	lsass.exe
1144	2.exe
2216	winnthlp1.exe
2136	winnthlp2.exe
1788	2.exe
2188	winnthlp1.exe
608	winnthlp2.exe
1080	2.exe
2336	winnthlp1.exe
1800	winnthlp2.exe
2480	2.exe
2584	winnthlp1.exe
1692	winnthlp2.exe
1092	2.exe
2408	winnthlp1.exe
1548	winnthlp2.exe
2224	2.exe
1700	2.exe
2644	winnthlp1.exe
2944	winnthlp2.exe
1364	2.exe
2912	2.exe
2224	winnthlp1.exe
3024	winnthlp2.exe
2940	2.exe
1652	winnthlp1.exe
2900	2.exe
1732	winnthlp2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2760	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	29
PID 2100 wrote to memory of 2760	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	29
PID 2100 wrote to memory of 2760	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	29
PID 2100 wrote to memory of 2760	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	29
PID 2100 wrote to memory of 2364	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	31
PID 2100 wrote to memory of 2364	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	31
PID 2100 wrote to memory of 2364	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	31
PID 2100 wrote to memory of 2364	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	31
PID 2364 wrote to memory of 2664	2364	DirLock.exe	32
PID 2364 wrote to memory of 2664	2364	DirLock.exe	32
PID 2364 wrote to memory of 2664	2364	DirLock.exe	32
PID 2364 wrote to memory of 2664	2364	DirLock.exe	32
PID 2664 wrote to memory of 2592	2664	2.exe	33
PID 2664 wrote to memory of 2592	2664	2.exe	33
PID 2664 wrote to memory of 2592	2664	2.exe	33
PID 2664 wrote to memory of 2592	2664	2.exe	33
PID 2664 wrote to memory of 2532	2664	2.exe	34
PID 2664 wrote to memory of 2532	2664	2.exe	34
PID 2664 wrote to memory of 2532	2664	2.exe	34
PID 2664 wrote to memory of 2532	2664	2.exe	34
PID 2100 wrote to memory of 2492	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	35
PID 2100 wrote to memory of 2492	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	35
PID 2100 wrote to memory of 2492	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	35
PID 2100 wrote to memory of 2492	2100	cbf5bdb17cc3feccd573feab9655a7a5.exe	35
PID 2532 wrote to memory of 2120	2532	winnthlp2.exe	38
PID 2532 wrote to memory of 2120	2532	winnthlp2.exe	38
PID 2532 wrote to memory of 2120	2532	winnthlp2.exe	38
PID 2532 wrote to memory of 2120	2532	winnthlp2.exe	38
PID 2592 wrote to memory of 2920	2592	winnthlp1.exe	39
PID 2592 wrote to memory of 2920	2592	winnthlp1.exe	39
PID 2592 wrote to memory of 2920	2592	winnthlp1.exe	39
PID 2592 wrote to memory of 2920	2592	winnthlp1.exe	39
PID 2492 wrote to memory of 1144	2492	lsass.exe	43
PID 2492 wrote to memory of 1144	2492	lsass.exe	43
PID 2492 wrote to memory of 1144	2492	lsass.exe	43
PID 2492 wrote to memory of 1144	2492	lsass.exe	43
PID 1144 wrote to memory of 2216	1144	2.exe	44
PID 1144 wrote to memory of 2216	1144	2.exe	44
PID 1144 wrote to memory of 2216	1144	2.exe	44
PID 1144 wrote to memory of 2216	1144	2.exe	44
PID 1144 wrote to memory of 2136	1144	2.exe	45
PID 1144 wrote to memory of 2136	1144	2.exe	45
PID 1144 wrote to memory of 2136	1144	2.exe	45
PID 1144 wrote to memory of 2136	1144	2.exe	45
PID 2216 wrote to memory of 2704	2216	winnthlp1.exe	46
PID 2216 wrote to memory of 2704	2216	winnthlp1.exe	46
PID 2216 wrote to memory of 2704	2216	winnthlp1.exe	46
PID 2216 wrote to memory of 2704	2216	winnthlp1.exe	46
PID 2136 wrote to memory of 3028	2136	winnthlp2.exe	49
PID 2136 wrote to memory of 3028	2136	winnthlp2.exe	49
PID 2136 wrote to memory of 3028	2136	winnthlp2.exe	49
PID 2136 wrote to memory of 3028	2136	winnthlp2.exe	49
PID 2364 wrote to memory of 1788	2364	DirLock.exe	51
PID 2364 wrote to memory of 1788	2364	DirLock.exe	51
PID 2364 wrote to memory of 1788	2364	DirLock.exe	51
PID 2364 wrote to memory of 1788	2364	DirLock.exe	51
PID 1788 wrote to memory of 2188	1788	2.exe	52
PID 1788 wrote to memory of 2188	1788	2.exe	52
PID 1788 wrote to memory of 2188	1788	2.exe	52
PID 1788 wrote to memory of 2188	1788	2.exe	52
PID 1788 wrote to memory of 608	1788	2.exe	112
PID 1788 wrote to memory of 608	1788	2.exe	112
PID 1788 wrote to memory of 608	1788	2.exe	112
PID 1788 wrote to memory of 608	1788	2.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\cbf5bdb17cc3feccd573feab9655a7a5.exe
"C:\Users\Admin\AppData\Local\Temp\cbf5bdb17cc3feccd573feab9655a7a5.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\cbf5bdb17cc3feccd573feab9655a7a5
  2⤵
  PID:2760
- C:\ProgramData\application data\Lambda\DirLock.exe
  "C:\ProgramData\application data\Lambda\DirLock.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\p7xdxj-p4y21j-kqqqio-8oib70-rd2w9h\2.exe
    C:\Users\Admin\AppData\Local\Temp\p7xdxj-p4y21j-kqqqio-8oib70-rd2w9h\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2920
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2120
- - C:\Users\Admin\AppData\Local\Temp\d9jpk9-jzu672-9n0agd-3e3pni-h31qg5\2.exe
    C:\Users\Admin\AppData\Local\Temp\d9jpk9-jzu672-9n0agd-3e3pni-h31qg5\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1604
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:608
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2888
- - C:\Users\Admin\AppData\Local\Temp\wi56x6-x9u4b5-tqb129-hjsw1k-bg61yq\2.exe
    C:\Users\Admin\AppData\Local\Temp\wi56x6-x9u4b5-tqb129-hjsw1k-bg61yq\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2336
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:824
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1292
- - C:\Users\Admin\AppData\Local\Temp\5zu5ub-dkuwq3-dgulu3-82m8b8-w1eu0k\2.exe
    C:\Users\Admin\AppData\Local\Temp\5zu5ub-dkuwq3-dgulu3-82m8b8-w1eu0k\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2644
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:988
- - C:\Users\Admin\AppData\Local\Temp\uxtcqh-wi7jff-38i118-svo5aj-nnrjho\2.exe
    C:\Users\Admin\AppData\Local\Temp\uxtcqh-wi7jff-38i118-svo5aj-nnrjho\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:1364
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:980
- - C:\Users\Admin\AppData\Local\Temp\lzqj5p-tefjbg-u54hqf-01rp29-pt8k1l\2.exe
    C:\Users\Admin\AppData\Local\Temp\lzqj5p-tefjbg-u54hqf-01rp29-pt8k1l\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    PID:2940
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:760
- - C:\Users\Admin\AppData\Local\Temp\dp7mbd-g5a2aa-x4g4rt-nmaib3-sn8hdx\2.exe
    C:\Users\Admin\AppData\Local\Temp\dp7mbd-g5a2aa-x4g4rt-nmaib3-sn8hdx\2.exe
    3⤵
    PID:1640
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1384
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2816
- - C:\Users\Admin\AppData\Local\Temp\cdgmyp-v1z705-61jq9u-drv7wn-2e0b5y\2.exe
    C:\Users\Admin\AppData\Local\Temp\cdgmyp-v1z705-61jq9u-drv7wn-2e0b5y\2.exe
    3⤵
    PID:792
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:368
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2860
- - C:\Users\Admin\AppData\Local\Temp\urdv0m-7gbwu9-pa67mq-q0v50q-wwidck\2.exe
    C:\Users\Admin\AppData\Local\Temp\urdv0m-7gbwu9-pa67mq-q0v50q-wwidck\2.exe
    3⤵
    PID:2960
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:760
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1088
- - C:\Users\Admin\AppData\Local\Temp\r8c8we-bql28u-nlturh-v5tloa-v2u9sa\2.exe
    C:\Users\Admin\AppData\Local\Temp\r8c8we-bql28u-nlturh-v5tloa-v2u9sa\2.exe
    3⤵
    PID:3472
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3592
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3804
- - C:\Users\Admin\AppData\Local\Temp\u31jsu-i1u4h6-1qdpjn-3brw7l-a13dte\2.exe
    C:\Users\Admin\AppData\Local\Temp\u31jsu-i1u4h6-1qdpjn-3brw7l-a13dte\2.exe
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3424
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3604
- - C:\Users\Admin\AppData\Local\Temp\hs48uj-bk7n0p-o94ouc-73zzmt-7uox0t\2.exe
    C:\Users\Admin\AppData\Local\Temp\hs48uj-bk7n0p-o94ouc-73zzmt-7uox0t\2.exe
    3⤵
    PID:3812
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3932
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3496
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3244
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4036
- - C:\Users\Admin\AppData\Local\Temp\1awi4w-q3dc38-j0rize-wv09j2-3f00fu\2.exe
    C:\Users\Admin\AppData\Local\Temp\1awi4w-q3dc38-j0rize-wv09j2-3f00fu\2.exe
    3⤵
    PID:3116
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3644
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3664
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3892
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3764
- - C:\Users\Admin\AppData\Local\Temp\55odu7-0sg0bb-eb2bfx-7er614-905eq3\2.exe
    C:\Users\Admin\AppData\Local\Temp\55odu7-0sg0bb-eb2bfx-7er614-905eq3\2.exe
    3⤵
    PID:3340
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3532
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3720
- - C:\Users\Admin\AppData\Local\Temp\q6896f-ftedgp-alhrmv-nafsgi-53a48z\2.exe
    C:\Users\Admin\AppData\Local\Temp\q6896f-ftedgp-alhrmv-nafsgi-53a48z\2.exe
    3⤵
    PID:3636
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3324
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3680
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3300
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3700
- - C:\Users\Admin\AppData\Local\Temp\ic0gyh-o7noab-c04j9m-xjcdl2-9dl44q\2.exe
    C:\Users\Admin\AppData\Local\Temp\ic0gyh-o7noab-c04j9m-xjcdl2-9dl44q\2.exe
    3⤵
    PID:3268
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3696
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3560
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3560
- - C:\Users\Admin\AppData\Local\Temp\0w3a2q-qeynl0-vfwmnu-9yiwrg-sm2htx\2.exe
    C:\Users\Admin\AppData\Local\Temp\0w3a2q-qeynl0-vfwmnu-9yiwrg-sm2htx\2.exe
    3⤵
    PID:4652
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4724
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5100
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4796
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4932
- - C:\Users\Admin\AppData\Local\Temp\l8kvb6-syvcyz-il1g7a-cd4vef-p21w82\2.exe
    C:\Users\Admin\AppData\Local\Temp\l8kvb6-syvcyz-il1g7a-cd4vef-p21w82\2.exe
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4588
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4736
- - C:\Users\Admin\AppData\Local\Temp\mhne1f-n8dcge-t3zks8-8ha46t-2fp930\2.exe
    C:\Users\Admin\AppData\Local\Temp\mhne1f-n8dcge-t3zks8-8ha46t-2fp930\2.exe
    3⤵
    PID:3508
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4796
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4472
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4436
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4708
- - C:\Users\Admin\AppData\Local\Temp\m5qgzn-upq7vf-umqwzg-p8ikgk-d6a55w\2.exe
    C:\Users\Admin\AppData\Local\Temp\m5qgzn-upq7vf-umqwzg-p8ikgk-d6a55w\2.exe
    3⤵
    PID:4852
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4328
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4388
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2372
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5052
- - C:\Users\Admin\AppData\Local\Temp\r7w48g-ttacxe-0jltj7-zlx8d8-tc0nke\2.exe
    C:\Users\Admin\AppData\Local\Temp\r7w48g-ttacxe-0jltj7-zlx8d8-tc0nke\2.exe
    3⤵
    PID:4652
- - C:\Users\Admin\AppData\Local\Temp\3m8t3j-lg25u1-m7s380-jo8004-7gpuzf\2.exe
    C:\Users\Admin\AppData\Local\Temp\3m8t3j-lg25u1-m7s380-jo8004-7gpuzf\2.exe
    3⤵
    PID:5052
- - C:\Users\Admin\AppData\Local\Temp\ec6xnk-gs9emh-yrfg30-xog470-ta8so4\2.exe
    C:\Users\Admin\AppData\Local\Temp\ec6xnk-gs9emh-yrfg30-xog470-ta8so4\2.exe
    3⤵
    PID:4556
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4452
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4332
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4844
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2372
- - C:\Users\Admin\AppData\Local\Temp\hlmi7e-aocetl-c9plij-jz124c-8n77en\2.exe
    C:\Users\Admin\AppData\Local\Temp\hlmi7e-aocetl-c9plij-jz124c-8n77en\2.exe
    3⤵
    PID:4912
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4628
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4600
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3248
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:488
- - C:\Users\Admin\AppData\Local\Temp\iy5glt-vn2hfg-dhxt6y-e8mrlx-k39zxr\2.exe
    C:\Users\Admin\AppData\Local\Temp\iy5glt-vn2hfg-dhxt6y-e8mrlx-k39zxr\2.exe
    3⤵
    PID:4456
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4524
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4864
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2080
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5188
- - C:\Users\Admin\AppData\Local\Temp\54b89c-pnk1ls-1hst5g-92sk18-9yt959\2.exe
    C:\Users\Admin\AppData\Local\Temp\54b89c-pnk1ls-1hst5g-92sk18-9yt959\2.exe
    3⤵
    PID:5856
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5908
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5272
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5980
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6096
- - C:\Users\Admin\AppData\Local\Temp\4rn0ky-rpfl9b-bdz6ar-mdjokg-t3u669\2.exe
    C:\Users\Admin\AppData\Local\Temp\4rn0ky-rpfl9b-bdz6ar-mdjokg-t3u669\2.exe
    3⤵
    PID:5516
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5584
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5752
- - C:\Users\Admin\AppData\Local\Temp\ppkfny-khnuu4-x6kvnr-fzf6f8-gq54t7\2.exe
    C:\Users\Admin\AppData\Local\Temp\ppkfny-khnuu4-x6kvnr-fzf6f8-gq54t7\2.exe
    3⤵
    PID:5172
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5792
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5140
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5848
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5164
- - C:\Users\Admin\AppData\Local\Temp\d27oa3-2vojae-vs2o6l-8nbgq8-f7b7m1\2.exe
    C:\Users\Admin\AppData\Local\Temp\d27oa3-2vojae-vs2o6l-8nbgq8-f7b7m1\2.exe
    3⤵
    PID:5436
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4888
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5980
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5636
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5996
- - C:\Users\Admin\AppData\Local\Temp\ars5uw-5dktb0-tcdf0d-c0wz2t-ela7qs\2.exe
    C:\Users\Admin\AppData\Local\Temp\ars5uw-5dktb0-tcdf0d-c0wz2t-ela7qs\2.exe
    3⤵
    PID:5976
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2544
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4888
- - C:\Users\Admin\AppData\Local\Temp\ivziz9-7i5m9k-2a81fp-pebdu2-xt0d1u\2.exe
    C:\Users\Admin\AppData\Local\Temp\ivziz9-7i5m9k-2a81fp-pebdu2-xt0d1u\2.exe
    3⤵
    PID:5812
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5504
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5960
- - C:\Users\Admin\AppData\Local\Temp\d5hiio-j03qui-7tkltu-1qzqp0-4616oy\2.exe
    C:\Users\Admin\AppData\Local\Temp\d5hiio-j03qui-7tkltu-1qzqp0-4616oy\2.exe
    3⤵
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\an8wbr-0429u1-5508ww-jpmi0i-2d631z\2.exe
    C:\Users\Admin\AppData\Local\Temp\an8wbr-0429u1-5508ww-jpmi0i-2d631z\2.exe
    3⤵
    PID:5644
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\477x4h-438m8h-0p09pl-nnsvey-6ccfge\2.exe
    C:\Users\Admin\AppData\Local\Temp\477x4h-438m8h-0p09pl-nnsvey-6ccfge\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2704
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3028
- - C:\Users\Admin\AppData\Local\Temp\fznhp9-mpyzc2-bd43lc-647hsi-jt5im5\2.exe
    C:\Users\Admin\AppData\Local\Temp\fznhp9-mpyzc2-bd43lc-647hsi-jt5im5\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2480
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2584
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:860
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      PID:1692
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2224
- - C:\Users\Admin\AppData\Local\Temp\rsl1vp-sjaz9p-o0qw1s-dt7r04-7qmwwa\2.exe
    C:\Users\Admin\AppData\Local\Temp\rsl1vp-sjaz9p-o0qw1s-dt7r04-7qmwwa\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2528
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1768
- - C:\Users\Admin\AppData\Local\Temp\vnibuu-37i2qm-33iqun-yqaebr-mo3003\2.exe
    C:\Users\Admin\AppData\Local\Temp\vnibuu-37i2qm-33iqun-yqaebr-mo3003\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:2944
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2480
- - C:\Users\Admin\AppData\Local\Temp\aan227-cv19r5-jlcqdy-89ium9-30l9te\2.exe
    C:\Users\Admin\AppData\Local\Temp\aan227-cv19r5-jlcqdy-89ium9-30l9te\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:3024
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1816
- - C:\Users\Admin\AppData\Local\Temp\5zi659-7fln46-perplp-fwl25y-kxj16t\2.exe
    C:\Users\Admin\AppData\Local\Temp\5zi659-7fln46-perplp-fwl25y-kxj16t\2.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:1732
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:368
- - C:\Users\Admin\AppData\Local\Temp\o6dp37-8uxa5n-juhtec-qksa05-f7ye9g\2.exe
    C:\Users\Admin\AppData\Local\Temp\o6dp37-8uxa5n-juhtec-qksa05-f7ye9g\2.exe
    3⤵
    PID:2108
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:608
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2404
- - C:\Users\Admin\AppData\Local\Temp\x64qc3-av1r6q-spw2x8-tgl0b7-zb88n1\2.exe
    C:\Users\Admin\AppData\Local\Temp\x64qc3-av1r6q-spw2x8-tgl0b7-zb88n1\2.exe
    3⤵
    PID:2156
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1660
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1092
- - C:\Users\Admin\AppData\Local\Temp\yf4pco-iycio4-utla7s-2dl14k-2alq8k\2.exe
    C:\Users\Admin\AppData\Local\Temp\yf4pco-iycio4-utla7s-2dl14k-2alq8k\2.exe
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2096
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3264
- - C:\Users\Admin\AppData\Local\Temp\aat56z-y8lqvb-hx5bws-jijilq-q8u07j\2.exe
    C:\Users\Admin\AppData\Local\Temp\aat56z-y8lqvb-hx5bws-jijilq-q8u07j\2.exe
    3⤵
    PID:3524
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3640
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3812
- - C:\Users\Admin\AppData\Local\Temp\bnglmj-6fj0tp-j4g1nb-1xbcet-2o1ats\2.exe
    C:\Users\Admin\AppData\Local\Temp\bnglmj-6fj0tp-j4g1nb-1xbcet-2o1ats\2.exe
    3⤵
    PID:3348
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3448
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3676
- - C:\Users\Admin\AppData\Local\Temp\aqz1zr-zigwy3-tgv1u9-5a3tex-dv3kap\2.exe
    C:\Users\Admin\AppData\Local\Temp\aqz1zr-zigwy3-tgv1u9-5a3tex-dv3kap\2.exe
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Local\Temp\3gcn7g-y33aol-cmqls7-5pfgfe-7ato3c\2.exe
    C:\Users\Admin\AppData\Local\Temp\3gcn7g-y33aol-cmqls7-5pfgfe-7ato3c\2.exe
    3⤵
    PID:3268
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3632
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3480
- - C:\Users\Admin\AppData\Local\Temp\j7rygl-8uw2pw-3mzgw1-gbxhqo-y4sth6\2.exe
    C:\Users\Admin\AppData\Local\Temp\j7rygl-8uw2pw-3mzgw1-gbxhqo-y4sth6\2.exe
    3⤵
    PID:3500
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:888
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3660
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3864
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3700
- - C:\Users\Admin\AppData\Local\Temp\9v7o1x-fqtwdr-3jarc3-n1jkoj-0wrc87\2.exe
    C:\Users\Admin\AppData\Local\Temp\9v7o1x-fqtwdr-3jarc3-n1jkoj-0wrc87\2.exe
    3⤵
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\z0m573-pigiqd-ujehs8-821rwu-sqkcyb\2.exe
    C:\Users\Admin\AppData\Local\Temp\z0m573-pigiqd-ujehs8-821rwu-sqkcyb\2.exe
    3⤵
    PID:2784
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3696
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4460
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4152
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4260
- - C:\Users\Admin\AppData\Local\Temp\383r63-aye8sw-0lkc27-udnr8d-72ls2z\2.exe
    C:\Users\Admin\AppData\Local\Temp\383r63-aye8sw-0lkc27-udnr8d-72ls2z\2.exe
    3⤵
    PID:4320
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4260
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4976
- - C:\Users\Admin\AppData\Local\Temp\gkr5ke-hag3zd-n63cb7-2kevps-whs0mz\2.exe
    C:\Users\Admin\AppData\Local\Temp\gkr5ke-hag3zd-n63cb7-2kevps-whs0mz\2.exe
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\6svufn-ecvlbf-e9v9ff-9vnxwk-xtgjlw\2.exe
    C:\Users\Admin\AppData\Local\Temp\6svufn-ecvlbf-e9v9ff-9vnxwk-xtgjlw\2.exe
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Local\Temp\m0d38v-omrawu-uc2sin-tde7co-o5hmjt\2.exe
    C:\Users\Admin\AppData\Local\Temp\m0d38v-omrawu-uc2sin-tde7co-o5hmjt\2.exe
    3⤵
    PID:4448
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1576
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4704
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5032
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4744
- - C:\Users\Admin\AppData\Local\Temp\gf6ugc-y9157t-z0q3ls-wh70dw-k9ovc8\2.exe
    C:\Users\Admin\AppData\Local\Temp\gf6ugc-y9157t-z0q3ls-wh70dw-k9ovc8\2.exe
    3⤵
    PID:5064
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4268
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4540
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5100
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4628
- - C:\Users\Admin\AppData\Local\Temp\nt0pj3-p926i1-7898zj-759x4j-2r1klo\2.exe
    C:\Users\Admin\AppData\Local\Temp\nt0pj3-p926i1-7898zj-759x4j-2r1klo\2.exe
    3⤵
    PID:4996
- - C:\Users\Admin\AppData\Local\Temp\bop9qd-4rf5dk-6ctc1i-d24unb-2payxm\2.exe
    C:\Users\Admin\AppData\Local\Temp\bop9qd-4rf5dk-6ctc1i-d24unb-2payxm\2.exe
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Local\Temp\n92486-0y051t-isvgta-jjke79-pe7nj3\2.exe
    C:\Users\Admin\AppData\Local\Temp\n92486-0y051t-isvgta-jjke79-pe7nj3\2.exe
    3⤵
    PID:5300
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5348
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5544
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5424
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5588
- - C:\Users\Admin\AppData\Local\Temp\9julin-t12eu3-6wb6dr-dgbxaj-ddbmej\2.exe
    C:\Users\Admin\AppData\Local\Temp\9julin-t12eu3-6wb6dr-dgbxaj-ddbmej\2.exe
    3⤵
    PID:572
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5460
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5744
- - C:\Users\Admin\AppData\Local\Temp\ly67nm-9wytcy-skiddf-3k2wn4-aadd9x\2.exe
    C:\Users\Admin\AppData\Local\Temp\ly67nm-9wytcy-skiddf-3k2wn4-aadd9x\2.exe
    3⤵
    PID:2520
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6088
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5344
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5168
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5952
- - C:\Users\Admin\AppData\Local\Temp\pr5ctq-kj9q0w-x86ruj-f112l0-gsq000\2.exe
    C:\Users\Admin\AppData\Local\Temp\pr5ctq-kj9q0w-x86ruj-f112l0-gsq000\2.exe
    3⤵
    PID:5144
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5464
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5492
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5336
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5520
- - C:\Users\Admin\AppData\Local\Temp\bi1nse-0aiirp-u8xnov-626f7j-en664b\2.exe
    C:\Users\Admin\AppData\Local\Temp\bi1nse-0aiirp-u8xnov-626f7j-en664b\2.exe
    3⤵
    PID:5656
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6084
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5892
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4520
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5688
- - C:\Users\Admin\AppData\Local\Temp\1mpzq6-x8hn7a-l798wn-4vttx3-5g70m2\2.exe
    C:\Users\Admin\AppData\Local\Temp\1mpzq6-x8hn7a-l798wn-4vttx3-5g70m2\2.exe
    3⤵
    PID:5392
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6060
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5144
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5716
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5908
- - C:\Users\Admin\AppData\Local\Temp\g278jg-5qddsr-0hgrzw-nlk3da-v083k1\2.exe
    C:\Users\Admin\AppData\Local\Temp\g278jg-5qddsr-0hgrzw-nlk3da-v083k1\2.exe
    3⤵
    PID:5772
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5400
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5348
- - C:\Users\Admin\AppData\Local\Temp\vzwgyg-1ujoaa-qn0j9l-kkeo5s-m0h54p\2.exe
    C:\Users\Admin\AppData\Local\Temp\vzwgyg-1ujoaa-qn0j9l-kkeo5s-m0h54p\2.exe
    3⤵
    PID:5632
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5216
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6044
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6080
- - C:\Users\Admin\AppData\Local\Temp\7jjtsg-x1e6cq-22c5ek-glygi6-z9i0jn\2.exe
    C:\Users\Admin\AppData\Local\Temp\7jjtsg-x1e6cq-22c5ek-glygi6-z9i0jn\2.exe
    3⤵
    PID:4432
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5772
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5152
- - C:\Users\Admin\AppData\Local\Temp\n90sm5-uzc98y-jnhdi9-eelsoe-r3iti1\2.exe
    C:\Users\Admin\AppData\Local\Temp\n90sm5-uzc98y-jnhdi9-eelsoe-r3iti1\2.exe
    3⤵
    PID:4560
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5240
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5392
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4520
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2088
- - C:\Users\Admin\AppData\Local\Temp\3zjqa2-4q8oo1-alvw0v-yecrz7-ixklbn\2.exe
    C:\Users\Admin\AppData\Local\Temp\3zjqa2-4q8oo1-alvw0v-yecrz7-ixklbn\2.exe
    3⤵
    PID:5324
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6060
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6084
- - C:\Users\Admin\AppData\Local\Temp\nj2tnb-v32kk3-v039o3-qmvw57-ekniuk\2.exe
    C:\Users\Admin\AppData\Local\Temp\nj2tnb-v32kk3-v039o3-qmvw57-ekniuk\2.exe
    3⤵
    PID:4628
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5712
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4520
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5484
- - C:\Users\Admin\AppData\Local\Temp\5zst4z-6l61sy-dbhier-cdtx8s-74wcfx\2.exe
    C:\Users\Admin\AppData\Local\Temp\5zst4z-6l61sy-dbhier-cdtx8s-74wcfx\2.exe
    3⤵
    PID:1504
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5568
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5464
- - C:\Users\Admin\AppData\Local\Temp\nfmbin-58hm94-6z6ko3-2gnhf7-r94cej\2.exe
    C:\Users\Admin\AppData\Local\Temp\nfmbin-58hm94-6z6ko3-2gnhf7-r94cej\2.exe
    3⤵
    PID:5880
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5884
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6204
- - C:\Users\Admin\AppData\Local\Temp\ujshtl-7e19d8-ey1z91-ev2oe1-ahucv5\2.exe
    C:\Users\Admin\AppData\Local\Temp\ujshtl-7e19d8-ey1z91-ev2oe1-ahucv5\2.exe
    3⤵
    PID:6340
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6416
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2460

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2416

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1948

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2936

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1284

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2060

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1072

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1600

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1864

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1368

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1820

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2208

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:1140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:880

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1700

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2696

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3076

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3312

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4064

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3176

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3352

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3204

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1164

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3652

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3108

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4956

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5092

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4224

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4772

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4544

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4964

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4984

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4888

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6316

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6616

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6740

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6784

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6828

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6876

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6924

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7012

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7056

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7100

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7152

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5504

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5528

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6328

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6552

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6664

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5788

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2100-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads