6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b

Analysis

max time kernel
4s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Size 3.5MB
Sample260424-vdbmqsft4r
SHA256 6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b
MD5 fb7a3b21a7e912901194344c7741a2ce
SHA1 1c6b2d28a12314c6974870a50bbe0cc07700a19d
SHA512 8c9325016e4c006b27cd14912e7c4c8cfe947aed51db04530b0dcf64cb714424212883fc19214da99d28e3f331a1d7387aa547dbbf57957afb120473ee6edbe7
SSDEEP 49152:bjoYhfn+dvGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IY2vj38yuvBfuv21n8U
TLSH
T176066B53B210DB73C0DD12399CFBFB118679BC2A4B3556233A893B1D3AB62A4471B197
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 10 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wincheck.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wincheck.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe

Executes dropped EXE 1 IoCs

pid	Process
3872	wincheck.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCheck = "C:\\wincheck.exe"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCheck = "C:\\wincheck.exe"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCheck = "C:\\wincheck.exe"	wincheck.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCheck = "C:\\wincheck.exe"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsCheck = "C:\\wincheck.exe"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wincheck.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe

Drops autorun.inf file 1 TTPs 20 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File opened for modification	C:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File opened for modification	C:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File opened for modification	F:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File opened for modification	C:\autorun.inf	wincheck.exe
File created	\??\E:\autorun.inf	wincheck.exe
File opened for modification	F:\autorun.inf	wincheck.exe
File created	D:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File opened for modification	F:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	C:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	F:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	\??\E:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	D:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	\??\E:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	\??\E:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	D:\autorun.inf	wincheck.exe
File created	\??\E:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	D:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File created	D:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
File opened for modification	F:\autorun.inf	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wincheck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1080	5068	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe	80
PID 1080 wrote to memory of 3980	1080	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe	81
PID 3980 wrote to memory of 5112	3980	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe	83
PID 5112 wrote to memory of 3172	5112	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe	85

System policy modification 1 TTPs 10 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wincheck.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wincheck.exe

C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
"C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5068
- C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
  "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
  2⤵
  - UAC bypass
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops autorun.inf file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
    "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
    3⤵
    - UAC bypass
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
      "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
      4⤵
      UAC bypass
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops autorun.inf file
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        5⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        8⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        9⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        10⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        11⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        12⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        13⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        14⤵
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        15⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        16⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        17⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        18⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        19⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        20⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        21⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        22⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        23⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        24⤵
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        25⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        26⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        27⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        28⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        29⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        30⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        31⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        32⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        33⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        34⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        35⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        36⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        37⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        38⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        39⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        40⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        41⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        42⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        43⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        44⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        45⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        46⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        47⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        48⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        49⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        50⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        51⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        52⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        53⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        54⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        55⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        56⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        57⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        58⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        59⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        60⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        61⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        62⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        63⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        64⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        65⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        66⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        67⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        68⤵
        
        PID:424
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        69⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        70⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        71⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        72⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        73⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        74⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        75⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        76⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        77⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        78⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        79⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        80⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        81⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        82⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        83⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        84⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        85⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        86⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        87⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        88⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        89⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        90⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        91⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        92⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        93⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        94⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        95⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        96⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        97⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        98⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        99⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        100⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        101⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        102⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        103⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        104⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        105⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        106⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        107⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        108⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        109⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        110⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        111⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        112⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        113⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        114⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        115⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        116⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        117⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        118⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        119⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        120⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        121⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        122⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        123⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        124⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        125⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        126⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        127⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        128⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        129⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        130⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        131⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        132⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        133⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        134⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        135⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        136⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        137⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        138⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        139⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        140⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        141⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        142⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        143⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        144⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        145⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b.exe"
        146⤵
        
        PID:8308

C:\wincheck.exe
C:\wincheck.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- System policy modification
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AcroFnt19.lst.exe

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst.exe
Size 3.5MB
SHA256 3ffe5092aff37a77adcbe237e4230de1723cc628327483217b4214ef0270daf5
MD5 0d385c8d35bec8d06899104747c484fd
SHA1 f20b15001ee6c990087c145b82a979ebba52c679
SHA512 fdf808f27383af1184551c15880da2ebb7c290945fcedeb1ecfef31f146b5a4fda0801d478ae4591a9e3aa31907157efb61ddf8b94f5cca8c07f39d617fda6d8
SSDEEP 49152:bjoYhfn+dvGG3CqYzDMAauvwqm4uv5X9Xn8UW:IY2vj38yuvBfuvJ1n8U
TLSH
T152066B53F210DB73C0DD12399CFBFB118679BC2A4B3556233A893B1D2AB62A4471B197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedDataEvents.exe

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.exe
Size 3.5MB
SHA256 b72008bc43ec15944d7a9679edb907336e409c53ff8ecd74487dfd88526fca45
MD5 5ef9192f961447294baf0bd8ed488884
SHA1 313c5a02f4263d5eb90524409f531f471b97dbf0
SHA512 e24ff2f37c6b14fcc0eecb53bf8e3c1c274fa81030122647177a7d7cd7c99a72bfa26f689540cb98bf51cd7e71331cecf1a6725e7daaaf91156d5f958a54c646
SSDEEP 49152:bjoYhfndGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IY/j38yuvBfuv21n8U
TLSH
T115067C52B210CB73C0CD22399CEBFB118A79BD2A4B3557533649371D3AB63A4471B29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UserCache.bin.exe

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.exe
Size 1.9MB
SHA256 aa4672019599ce960b9362b3bcf03324417988340134c3c1462160c747993041
MD5 a4ac7018239158b1854607b0e00b03ce
SHA1 ce6d2c0dc2717567c473ef91d58be90d12a862fc
SHA512 c55587548956bc9a75d5a5185430fbffe9a678304931200861df403033e1d70149aba3118adc76f993286bfcb169c6b8582f197971084901cc44da3097197551
SSDEEP 6144:++M5mkg7RfMDjR+M5mkg7RfMDjP9XC1tNKMQ0wlvrqfuJsUAApbDxrEi4h:6mkgymkgoY7NKMQ0wlvufV2rEi4h
TLSH
T17C959612B241D6B3D49C02309CFBFB11827EB8264F7557633BDE1B5E3AB22E54622197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsRGB.icc.exe

Path C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.exe
Size 3.5MB
SHA256 d7f3c1960ca23f00f51105a7dbc007a4c802771aecbfc576290dc77f07306bfa
MD5 fcb13965fe413c55b0351ded0664ada8
SHA1 815e5f17588b9491d4abceb13f57f1a55523cf1f
SHA512 ba5691dc5475a6c4c2ba5eb5e7dbd478cff0846559e6ffdfb42000392741d663a89c2caa4438306147ff3c40c75bb17e9086c26390ef8e72bd2cf91bc8b871b2
SSDEEP 49152:bjoYhfR+dvGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IYYvj38yuvBfuv21n8U
TLSH
T198067C53B210CB73C0DD22399CEBFB118A79BD2A4B3557633688371D2AB6394471B297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActivitiesCache.db-shm.exe

Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db-shm.exe
Size 3.5MB
SHA256 420606f16bb6f70fe5bd07b9aa274dd3bf2ec3b2ac3e8f306cb96825423c7df3
MD5 e1f516af16dd82b9ba2f1698c8c8bff6
SHA1 8f0721b9dd96508bab44f4e14270c400c396833e
SHA512 67629c175cac8c114757469302aec27a1974e3b320aafb8b825f3da986d7e3dac419caa825d3334a83f69d3db5bbf661d1c34169839012dbc4cbf361a7042427
SSDEEP 49152:bjoYhfnAvGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IYevj38yuvBfuv21n8U
TLSH
T1CC067C53B210CB73C0CD22399CEBFB118A79BD2A4B2557533649371D3AB63A4471B29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock.exe

Path C:\Users\Admin\AppData\Local\D3DSCache\45a5e5b635b28e7a\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock.exe
Size 3.5MB
SHA256 51a664b42edff2496253c53a6339629a68cf9b6af32c9d75f750d619a38d0334
MD5 ec48716f462372674ced817c93299f48
SHA1 eb087404b25acc513b57402a6dc006a56471e2bb
SHA512 ee7adec74f82a5395150299dcb8c5531aaed7c3f351d5e8bb4e7e64d14799668269c2464537418e50bd6c00d85ca8893ef728ea06dfba06923f1b21947e88ccd
SSDEEP 49152:bjoYhfNdvGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IYRvj38yuvBfuv21n8U
TLSH
T145068D53B210CB73C0CE22399CEBF7118979BD2A4B3556633648375D3AB6394472B29B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowsingTopicsState.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState.exe
Size 3.5MB
SHA256 1d32aaf43b9091c7f6bf4bc22f52e6318c554a670c66cd732fc898159362de4f
MD5 b3431711979dc8b113be72c26717aa81
SHA1 8053b63de04d017ee67fcea8b5e3a555f0e9c4b8
SHA512 4b00b11dda7b6a3bdd67f973f2ae46ea7afea469e37f7d329e18fbdbec545a9e2b784c2dc98c9ee0e2682be462d2d7d4ba825086edad0972d315eba9263f152a
SSDEEP 49152:bjoYC+dvGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IYVvj38yuvBfuv21n8U
TLSH
T10C068D53F210C773C0DD26399CEBEB118A79BD2A4B3556533A883B1D2A773A4431B197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.exe
Size 3.5MB
SHA256 bbf76c5065796ddfeb65514407a8d0aa1512e1ed4924a3b7fa29357c857d748c
MD5 f64094697d8802aaea91edd71eaa2d71
SHA1 9475d19c5c210ffe2fb63dc4e9978ef1f014ecd0
SHA512 3aa1163fdec456acdbedc4229ae1c4811d5565e63bd9369331087b5eaf25567c6fe97e19430369fdaa029e578a21a2c4a63cc91453b7379ec2cb3138e4bd6cf2
SSDEEP 49152:bjoYhfn+dvGG3CqYzDMAauvwqm4uv1aX9Xn7UW:IY2vj38yuvBfuv21n7U
TLSH
T161067D53F210D773C0CD12399CFBFB118679B82A4B3556633A892B5E3AB63A4431B197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old.exe
Size 3.3MB
SHA256 d619d7eceeb8112ebddab360f00268ccb51383c2cf72a4e375168fdac48c9018
MD5 30626b506e97019e933c3880a19f113d
SHA1 c10e687b8f461096b7f6a3c73f71bb837304b654
SHA512 dd1f3d26ba25bd579164fc6df503341771dfd8f6865b26cb7ef55901ab4128b5c0fff7103fa2ebf9d7044e69c171261be604388f12bfb0ea984dcacd29386146
SSDEEP 49152:bjoYhfn+dvGG3CqYzDMAauvwqm4uv1aX9Xnw:IY2vj38yuvBfuv21nw
TLSH
T1E0F57C53F210DB73C0CD22359CFBFB118679B82A4B3556633A892B5D3EB62A4431B197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path C:\autorun.inf
Size 66B
SHA256 584bf1382694ef056b857668ab92debb2abf6094ec65d9da10323a638b40cb00
MD5 cfd81f9112f383bb1f85edf54cd24253
SHA1 e2772f98eba691299ca1e7cc481a2b2537c1284c
SHA512 abce6bd2b8324f4c0e82c31e567de142897b3f64064cae5b1cb592787d07d297999bca3c173c5250b08718618afd512340c4d6f9cfa968a3d441a6c5b1be5ffb
TLSH
T1D3A002A0DA1A03C8320C20E10312047243CBB408130818341B9A05C624145892B1F444
MD5 SHA1 SHA512 TLSH

Submit Download

wincheck.exe

Path C:\wincheck.exe
Size 3.5MB
SHA256 6e4162f4ce051f6be2c617a1d958538a243d46f67b0a19529e8e0bf931efba6b
MD5 fb7a3b21a7e912901194344c7741a2ce
SHA1 1c6b2d28a12314c6974870a50bbe0cc07700a19d
SHA512 8c9325016e4c006b27cd14912e7c4c8cfe947aed51db04530b0dcf64cb714424212883fc19214da99d28e3f331a1d7387aa547dbbf57957afb120473ee6edbe7
SSDEEP 49152:bjoYhfn+dvGG3CqYzDMAauvwqm4uv1aX9Xn8UW:IY2vj38yuvBfuv21n8U
TLSH
T176066B53B210DB73C0DD12399CFBFB118679BC2A4B3556233A893B1D3AB62A4471B197
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-5997-0x0000000001350000-0x000000000140B000-memory.dmp

Download

memory/408-18110-0x0000000001350000-0x000000000140B000-memory.dmp

Download

memory/1000-20192-0x0000000000AB0000-0x0000000000B6B000-memory.dmp

Download

memory/1000-8416-0x0000000000AB0000-0x0000000000B6B000-memory.dmp

Download

memory/1080-2349-0x0000000000DE0000-0x0000000000E9B000-memory.dmp

Download

memory/1080-10300-0x0000000000DE0000-0x0000000000E9B000-memory.dmp

Download

memory/1080-14324-0x0000000000DE0000-0x0000000000E9B000-memory.dmp

Download

memory/1864-5998-0x00000000015F0000-0x00000000016AB000-memory.dmp

Download

memory/1864-18690-0x00000000015F0000-0x00000000016AB000-memory.dmp

Download

memory/2096-15891-0x0000000001920000-0x00000000019DB000-memory.dmp

Download

memory/2096-7895-0x0000000001920000-0x00000000019DB000-memory.dmp

Download

memory/2440-7896-0x0000000000B80000-0x0000000000C3B000-memory.dmp

Download

memory/2440-19574-0x0000000000B80000-0x0000000000C3B000-memory.dmp

Download

memory/2556-16994-0x0000000000FD0000-0x000000000108B000-memory.dmp

Download

memory/2556-4341-0x0000000000FD0000-0x000000000108B000-memory.dmp

Download

memory/2608-19546-0x00000000017A0000-0x000000000185B000-memory.dmp

Download

memory/2608-7318-0x00000000017A0000-0x000000000185B000-memory.dmp

Download

memory/2744-11218-0x0000000000DC0000-0x0000000000E7B000-memory.dmp

Download

memory/2948-8410-0x0000000001700000-0x00000000017BB000-memory.dmp

Download

memory/2948-20188-0x0000000001700000-0x00000000017BB000-memory.dmp

Download

memory/3076-20187-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/3076-8408-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/3172-15886-0x0000000001390000-0x000000000144B000-memory.dmp

Download

memory/3172-3648-0x0000000001390000-0x000000000144B000-memory.dmp

Download

memory/3872-3277-0x00000000015F0000-0x00000000016AB000-memory.dmp

Download

memory/3900-5442-0x0000000000C70000-0x0000000000D2B000-memory.dmp

Download

memory/3900-14327-0x0000000000C70000-0x0000000000D2B000-memory.dmp

Download

memory/3936-8414-0x00000000009A0000-0x0000000000A5B000-memory.dmp

Download

memory/3936-17249-0x00000000009A0000-0x0000000000A5B000-memory.dmp

Download

memory/3980-2566-0x0000000000A50000-0x0000000000B0B000-memory.dmp

Download

memory/3980-14325-0x0000000000A50000-0x0000000000B0B000-memory.dmp

Download

memory/4028-8403-0x00000000014D0000-0x000000000158B000-memory.dmp

Download

memory/4028-20181-0x00000000014D0000-0x000000000158B000-memory.dmp

Download

memory/4256-17572-0x0000000001360000-0x000000000141B000-memory.dmp

Download

memory/4256-9641-0x0000000001360000-0x000000000141B000-memory.dmp

Download

memory/4276-15366-0x00000000017F0000-0x00000000018AB000-memory.dmp

Download

memory/4276-7315-0x00000000017F0000-0x00000000018AB000-memory.dmp

Download

memory/4368-7894-0x0000000001720000-0x00000000017DB000-memory.dmp

Download

memory/4368-15888-0x0000000001720000-0x00000000017DB000-memory.dmp

Download

memory/4616-7316-0x0000000001800000-0x00000000018BB000-memory.dmp

Download

memory/4616-15367-0x0000000001800000-0x00000000018BB000-memory.dmp

Download

memory/4616-19540-0x0000000001800000-0x00000000018BB000-memory.dmp

Download

memory/4664-8412-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/4664-20189-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/4792-20182-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/4792-8405-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/4928-20179-0x0000000001740000-0x00000000017FB000-memory.dmp

Download

memory/4928-8401-0x0000000001740000-0x00000000017FB000-memory.dmp

Download

memory/5068-10299-0x0000000000C50000-0x0000000000D0B000-memory.dmp

Download

memory/5068-14323-0x0000000000C50000-0x0000000000D0B000-memory.dmp

Download

memory/5068-2344-0x0000000000C50000-0x0000000000D0B000-memory.dmp

Download

memory/5112-2901-0x0000000001090000-0x000000000114B000-memory.dmp

Download

memory/5112-14691-0x0000000001090000-0x000000000114B000-memory.dmp

Download

memory/5164-17573-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/5164-9646-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/5164-21090-0x00000000010D0000-0x000000000118B000-memory.dmp

Download

memory/5524-8399-0x0000000001680000-0x000000000173B000-memory.dmp

Download

memory/5524-20171-0x0000000001680000-0x000000000173B000-memory.dmp

Download

memory/6004-20193-0x0000000001180000-0x000000000123B000-memory.dmp

Download

memory/6004-12352-0x0000000001180000-0x000000000123B000-memory.dmp

Download

memory/6244-11220-0x0000000000A90000-0x0000000000B4B000-memory.dmp

Download

memory/6816-10304-0x00000000016B0000-0x000000000176B000-memory.dmp

Download

memory/6816-18111-0x00000000016B0000-0x000000000176B000-memory.dmp

Download

memory/6860-10798-0x0000000000850000-0x000000000090B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads