Overview

overview

10

Static

static

3

tmpzpnxyjp2.exe

windows10-2004-x64

10

tmpzpnxyjp2.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/05/2026, 14:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpzpnxyjp2.exe
  • Size 1016KB
  • Sample260522-rc9llads4p
  • SHA256 7461067b1c6d5c8b94f2ab1a7e80082193873eb5b75e8f20d301a3942b399e73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypykspapersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Family: Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Detect Pykspa worm 2 IoCs
    worm
  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • UAC bypass 3 TTPs 23 IoCs
    defense_evasiontrojan
  • Adds policy Run key to start application 2 TTPs 59 IoCs
    persistence
  • Disables RegEdit via registry modification 8 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 22 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 4 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 62 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmpzpnxyjp2.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpzpnxyjp2.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2828
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\users\admin\appdata\local\temp\tmpzpnxyjp2.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3304
      • C:\Users\Admin\AppData\Local\Temp\vgnkp.exe
        "C:\Users\Admin\AppData\Local\Temp\vgnkp.exe" "-C:\Users\Admin\AppData\Local\Temp\sogoeyqdzckxlvwv.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1324
      • C:\Users\Admin\AppData\Local\Temp\vgnkp.exe
        "C:\Users\Admin\AppData\Local\Temp\vgnkp.exe" "-C:\Users\Admin\AppData\Local\Temp\sogoeyqdzckxlvwv.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:3244
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\users\admin\appdata\local\temp\tmpzpnxyjp2.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:4636
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:4936
  • C:\Windows\igakcyshfkujzlopwc.exe
    igakcyshfkujzlopwc.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3888
  • C:\Windows\vwtgbaxpqyldwlrvfopmz.exe
    vwtgbaxpqyldwlrvfopmz.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\vwtgbaxpqyldwlrvfopmz.exe*."
      2⤵
      • Executes dropped EXE
      PID:1476
  • C:\Windows\sogoeyqdzckxlvwv.exe
    sogoeyqdzckxlvwv.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3880
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\sogoeyqdzckxlvwv.exe*."
      2⤵
      • Executes dropped EXE
      PID:1716
  • C:\Users\Admin\AppData\Local\Temp\sogoeyqdzckxlvwv.exe
    C:\Users\Admin\AppData\Local\Temp\sogoeyqdzckxlvwv.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3916
  • C:\Windows\ggcoigcttamdvjoraiie.exe
    ggcoigcttamdvjoraiie.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4752
  • C:\Users\Admin\AppData\Local\Temp\zwpypkdrosbpeprrx.exe
    C:\Users\Admin\AppData\Local\Temp\zwpypkdrosbpeprrx.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1084
  • C:\Windows\tsnyrojzyepfwjnpxed.exe
    tsnyrojzyepfwjnpxed.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\tsnyrojzyepfwjnpxed.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:940
  • C:\Windows\tsnyrojzyepfwjnpxed.exe
    tsnyrojzyepfwjnpxed.exe
    1⤵
    • Executes dropped EXE
    PID:3440
  • C:\Windows\zwpypkdrosbpeprrx.exe
    zwpypkdrosbpeprrx.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\zwpypkdrosbpeprrx.exe*."
      2⤵
      • Executes dropped EXE
      PID:3996
  • C:\Users\Admin\AppData\Local\Temp\igakcyshfkujzlopwc.exe
    C:\Users\Admin\AppData\Local\Temp\igakcyshfkujzlopwc.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3912
  • C:\Users\Admin\AppData\Local\Temp\tsnyrojzyepfwjnpxed.exe
    C:\Users\Admin\AppData\Local\Temp\tsnyrojzyepfwjnpxed.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3300
  • C:\Windows\ggcoigcttamdvjoraiie.exe
    ggcoigcttamdvjoraiie.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\ggcoigcttamdvjoraiie.exe*."
      2⤵
      • Executes dropped EXE
      PID:2292
  • C:\Users\Admin\AppData\Local\Temp\ggcoigcttamdvjoraiie.exe
    C:\Users\Admin\AppData\Local\Temp\ggcoigcttamdvjoraiie.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1488
  • C:\Windows\igakcyshfkujzlopwc.exe
    igakcyshfkujzlopwc.exe .
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
      "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\igakcyshfkujzlopwc.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2204
      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1248
      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
        3⤵
          PID:4608
        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
          3⤵
            PID:3448
          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
            3⤵
              PID:3980
            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
              3⤵
                PID:4724
              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                3⤵
                  PID:4592
                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                  3⤵
                    PID:4024
                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                    3⤵
                      PID:3204
                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                      3⤵
                        PID:212
                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                        3⤵
                          PID:4248
                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                          3⤵
                            PID:2284
                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                            3⤵
                              PID:400
                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                              3⤵
                                PID:4972
                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                3⤵
                                  PID:5088
                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                  3⤵
                                    PID:3172
                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                    3⤵
                                      PID:1044
                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                      3⤵
                                        PID:4644
                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                        3⤵
                                          PID:1128
                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                          3⤵
                                            PID:4652
                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                            3⤵
                                              PID:1936
                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                              3⤵
                                                PID:2600
                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                3⤵
                                                  PID:2956
                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                  3⤵
                                                    PID:4248
                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                    3⤵
                                                      PID:4812
                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                      3⤵
                                                        PID:3968
                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                        3⤵
                                                          PID:4000
                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                          3⤵
                                                            PID:3888
                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                            3⤵
                                                              PID:3996
                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                              3⤵
                                                                PID:1792
                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                3⤵
                                                                  PID:3776
                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                  3⤵
                                                                    PID:3080
                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                    3⤵
                                                                      PID:1492
                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                      3⤵
                                                                        PID:3952
                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                        3⤵
                                                                          PID:216
                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                          3⤵
                                                                            PID:3352
                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                            3⤵
                                                                              PID:3348
                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                              3⤵
                                                                                PID:3156
                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                3⤵
                                                                                  PID:3092
                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                  3⤵
                                                                                    PID:4648
                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                    3⤵
                                                                                      PID:2216
                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                      3⤵
                                                                                        PID:2508
                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                        3⤵
                                                                                          PID:3188
                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                          3⤵
                                                                                            PID:2304
                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                            3⤵
                                                                                              PID:2512
                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                              3⤵
                                                                                                PID:1372
                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                3⤵
                                                                                                  PID:1312
                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                  3⤵
                                                                                                    PID:3020
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                    3⤵
                                                                                                      PID:1516
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                      3⤵
                                                                                                        PID:3608
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                        3⤵
                                                                                                          PID:4312
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                          3⤵
                                                                                                            PID:4560
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                            3⤵
                                                                                                              PID:3688
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                              3⤵
                                                                                                                PID:3152
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                3⤵
                                                                                                                  PID:344
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                  3⤵
                                                                                                                    PID:4444
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                    3⤵
                                                                                                                      PID:3424
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                      3⤵
                                                                                                                        PID:392
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                        3⤵
                                                                                                                          PID:4328
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                          3⤵
                                                                                                                            PID:4772
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                            3⤵
                                                                                                                              PID:988
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                              3⤵
                                                                                                                                PID:1728
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:3716
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:4648
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:2216
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:2796
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:2320
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:4864
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:2248
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:5088
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:4896
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4112
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3240
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4912
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4308
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2968
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1948
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2848
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4972
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4204
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2984
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1936
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:368
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:652
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:3824
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:540
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3528
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3984
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1916
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3812
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3556
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1440
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:760
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2696
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4364
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:3172
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:5056
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:64
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:708
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4012
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4420
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3888
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4664
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3196
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1424
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:784
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4792
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:3796
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:3152
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:376
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3352
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:3452
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:448
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:5036
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2848
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:964
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4508
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3756
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:3680
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vfmov.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\vfmov.exe" "-C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4456
                                                                                                                                                                                                                                                                    • C:\Windows\trmcxnfbujxiypcgiqx.exe
                                                                                                                                                                                                                                                                      trmcxnfbujxiypcgiqx.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:3688
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\trmcxnfbujxiypcgiqx.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\trmcxnfbujxiypcgiqx.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4432
                                                                                                                                                                                                                                                                    • C:\Windows\ifzoixojbpcmbrdgho.exe
                                                                                                                                                                                                                                                                      ifzoixojbpcmbrdgho.exe .
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:1940
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\ifzoixojbpcmbrdgho.exe*."
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                    • C:\Windows\gfbsofyvpfugxpdilucb.exe
                                                                                                                                                                                                                                                                      gfbsofyvpfugxpdilucb.exe .
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:4892
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\gfbsofyvpfugxpdilucb.exe*."
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:2920
                                                                                                                                                                                                                                                                    • C:\Windows\ifzoixojbpcmbrdgho.exe
                                                                                                                                                                                                                                                                      ifzoixojbpcmbrdgho.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\gfbsofyvpfugxpdilucb.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\gfbsofyvpfugxpdilucb.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4864
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\snfskxmfvhsanblm.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:1708
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vvskhztrmdtgyrgmqajjg.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\vvskhztrmdtgyrgmqajjg.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:344
                                                                                                                                                                                                                                                                    • C:\Windows\sogoeyqdzckxlvwv.exe
                                                                                                                                                                                                                                                                      sogoeyqdzckxlvwv.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:3996
                                                                                                                                                                                                                                                                    • C:\Windows\zwpypkdrosbpeprrx.exe
                                                                                                                                                                                                                                                                      zwpypkdrosbpeprrx.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      PID:700
                                                                                                                                                                                                                                                                    • C:\Windows\vvskhztrmdtgyrgmqajjg.exe
                                                                                                                                                                                                                                                                      vvskhztrmdtgyrgmqajjg.exe .
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                      PID:2460
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\vvskhztrmdtgyrgmqajjg.exe*."
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                    • C:\Windows\vvskhztrmdtgyrgmqajjg.exe
                                                                                                                                                                                                                                                                      vvskhztrmdtgyrgmqajjg.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                      • C:\Windows\snfskxmfvhsanblm.exe
                                                                                                                                                                                                                                                                        snfskxmfvhsanblm.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:2448
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ifzoixojbpcmbrdgho.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\ifzoixojbpcmbrdgho.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:3092
                                                                                                                                                                                                                                                                      • C:\Windows\vwtgbaxpqyldwlrvfopmz.exe
                                                                                                                                                                                                                                                                        vwtgbaxpqyldwlrvfopmz.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                      • C:\Windows\zvocvjztkxjsgvgii.exe
                                                                                                                                                                                                                                                                        zvocvjztkxjsgvgii.exe .
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                        PID:2324
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\zvocvjztkxjsgvgii.exe*."
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                                                                                      • C:\Windows\gfbsofyvpfugxpdilucb.exe
                                                                                                                                                                                                                                                                        gfbsofyvpfugxpdilucb.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\vwtgbaxpqyldwlrvfopmz.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\vwtgbaxpqyldwlrvfopmz.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:708
                                                                                                                                                                                                                                                                        • C:\Windows\trmcxnfbujxiypcgiqx.exe
                                                                                                                                                                                                                                                                          trmcxnfbujxiypcgiqx.exe .
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\trmcxnfbujxiypcgiqx.exe*."
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\zvocvjztkxjsgvgii.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\zvocvjztkxjsgvgii.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:392
                                                                                                                                                                                                                                                                        • C:\Windows\snfskxmfvhsanblm.exe
                                                                                                                                                                                                                                                                          snfskxmfvhsanblm.exe .
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:3376
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe" "c:\windows\snfskxmfvhsanblm.exe*."
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                                                                                        • C:\Windows\zvocvjztkxjsgvgii.exe
                                                                                                                                                                                                                                                                          zvocvjztkxjsgvgii.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:3348

                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                Hijack Execution Flow

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1574

                                                                                                                                                                                                                                                                                Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1574.005

                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                T1547

                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                T1547.001

                                                                                                                                                                                                                                                                                Winlogon Helper DLL

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1547.004

                                                                                                                                                                                                                                                                                Hijack Execution Flow

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1574

                                                                                                                                                                                                                                                                                Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1574.005

                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1548

                                                                                                                                                                                                                                                                                Bypass User Account Control

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1548.002

                                                                                                                                                                                                                                                                                Hijack Execution Flow

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1574

                                                                                                                                                                                                                                                                                Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1574.005

                                                                                                                                                                                                                                                                                Impair Defenses

                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                T1562

                                                                                                                                                                                                                                                                                Disable or Modify Tools

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1562.001

                                                                                                                                                                                                                                                                                Safe Mode Boot

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1562.009

                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                fotoryddmcxxyvjvnensnqxcc.bww
                                                                                                                                                                                                                                                                                • Path C:\Program Files (x86)\fotoryddmcxxyvjvnensnqxcc.bww
                                                                                                                                                                                                                                                                                • Size 280B
                                                                                                                                                                                                                                                                                • SHA256 cc4001b317cf6bbb1e8f471edee6c8278789722754ed0e89ece45026f4e307c2
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                jmudieyytwe.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\jmudieyytwe.exe
                                                                                                                                                                                                                                                                                • Size 320KB
                                                                                                                                                                                                                                                                                • SHA256 d3ff5a388b30d4b22bb00fb9c0545c939ebf35096d487a609d0138451d150d2a
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                vgnkp.exe
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\vgnkp.exe
                                                                                                                                                                                                                                                                                • Size 712KB
                                                                                                                                                                                                                                                                                • SHA256 eaea2855f26790d92a8ec2f6db24418f586e0879cab54242f55817bd43fae054
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                fotoryddmcxxyvjvnensnqxcc.bww
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\fotoryddmcxxyvjvnensnqxcc.bww
                                                                                                                                                                                                                                                                                • Size 280B
                                                                                                                                                                                                                                                                                • SHA256 845e2c62b5c114339e7b3c9c26890561b3b532032b3af8fcd22e13695c721993
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                fotoryddmcxxyvjvnensnqxcc.bww
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\fotoryddmcxxyvjvnensnqxcc.bww
                                                                                                                                                                                                                                                                                • Size 280B
                                                                                                                                                                                                                                                                                • SHA256 b1dcce2283c093e80ea832c26a434088dafd16886a2fde57a403b9dcef201861
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                keuaogwhbcitfnmjmoiyeskalfgmxjrqnqsm.iwo
                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\keuaogwhbcitfnmjmoiyeskalfgmxjrqnqsm.iwo
                                                                                                                                                                                                                                                                                • Size 4KB
                                                                                                                                                                                                                                                                                • SHA256 dd8a9e697bacc2ead83f0df9f61b6934d2da157b665dc51a8e0d52817e158e18
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                igakcyshfkujzlopwc.exe
                                                                                                                                                                                                                                                                                • Path C:\Windows\SysWOW64\igakcyshfkujzlopwc.exe
                                                                                                                                                                                                                                                                                • Size 1016KB
                                                                                                                                                                                                                                                                                • SHA256 7461067b1c6d5c8b94f2ab1a7e80082193873eb5b75e8f20d301a3942b399e73
                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                Submit Download