Overview

overview

10

Static

static

3

tmpv4c9m3lz.exe

windows10-ltsc_2021-x64

10

tmpv4c9m3lz.exe

windows10-2004-x64

10

tmpv4c9m3lz.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 15:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpv4c9m3lz.exe
  • Size 1016KB
  • Sample260522-sllrkahw21
  • SHA256 19bfc62f4162a8399e6c22f14721710d96007e027aaa8154e3d80bb725c360e4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypykspapersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Family: Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Detect Pykspa worm 2 IoCs
    worm
  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • UAC bypass 3 TTPs 24 IoCs
    defense_evasiontrojan
  • Adds policy Run key to start application 2 TTPs 64 IoCs
    persistence
  • Disables RegEdit via registry modification 8 IoCs
    defense_evasion
  • Executes dropped EXE 34 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 24 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 4 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 64 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmpv4c9m3lz.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpv4c9m3lz.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5212
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\users\admin\appdata\local\temp\tmpv4c9m3lz.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5292
      • C:\Users\Admin\AppData\Local\Temp\hqubkk.exe
        "C:\Users\Admin\AppData\Local\Temp\hqubkk.exe" "-C:\Users\Admin\AppData\Local\Temp\tmarkuobtljapdsd.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1732
      • C:\Users\Admin\AppData\Local\Temp\hqubkk.exe
        "C:\Users\Admin\AppData\Local\Temp\hqubkk.exe" "-C:\Users\Admin\AppData\Local\Temp\tmarkuobtljapdsd.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2656
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\users\admin\appdata\local\temp\tmpv4c9m3lz.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:4964
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:6052
  • C:\Windows\wunjhwvnkhkgatndspngc.exe
    wunjhwvnkhkgatndspngc.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:5844
  • C:\Windows\tmarkuobtljapdsd.exe
    tmarkuobtljapdsd.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\tmarkuobtljapdsd.exe*."
      2⤵
      • Executes dropped EXE
      PID:5064
  • C:\Windows\tmarkuobtljapdsd.exe
    tmarkuobtljapdsd.exe
    1⤵
    • Executes dropped EXE
    PID:5912
  • C:\Users\Admin\AppData\Local\Temp\tmarkuobtljapdsd.exe
    C:\Users\Admin\AppData\Local\Temp\tmarkuobtljapdsd.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3124
  • C:\Windows\uqhbxkhxsnoiarjxkfb.exe
    uqhbxkhxsnoiarjxkfb.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\uqhbxkhxsnoiarjxkfb.exe*."
      2⤵
      • Executes dropped EXE
      PID:4944
  • C:\Users\Admin\AppData\Local\Temp\uqhbxkhxsnoiarjxkfb.exe
    C:\Users\Admin\AppData\Local\Temp\uqhbxkhxsnoiarjxkfb.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2352
  • C:\Windows\jeuniuqfzttmdtkxjd.exe
    jeuniuqfzttmdtkxjd.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2436
  • C:\Users\Admin\AppData\Local\Temp\jeuniuqfzttmdtkxjd.exe
    C:\Users\Admin\AppData\Local\Temp\jeuniuqfzttmdtkxjd.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3316
  • C:\Users\Admin\AppData\Local\Temp\aujbvgbpibasixnzk.exe
    C:\Users\Admin\AppData\Local\Temp\aujbvgbpibasixnzk.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1240
  • C:\Windows\hewrocarnjlgzrkznjgy.exe
    hewrocarnjlgzrkznjgy.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4600
  • C:\Windows\hewrocarnjlgzrkznjgy.exe
    hewrocarnjlgzrkznjgy.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\hewrocarnjlgzrkznjgy.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:3788
  • C:\Windows\aujbvgbpibasixnzk.exe
    aujbvgbpibasixnzk.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\aujbvgbpibasixnzk.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:4696
      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:6108
      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
        3⤵
          PID:3184
        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
          3⤵
            PID:4936
          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
            3⤵
              PID:2504
            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
              3⤵
                PID:6076
              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                3⤵
                  PID:1452
                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                  3⤵
                    PID:3984
                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                    3⤵
                      PID:4968
                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                      3⤵
                        PID:1216
                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                        3⤵
                          PID:1748
                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                          3⤵
                            PID:1896
                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                            3⤵
                              PID:2244
                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                              3⤵
                                PID:1860
                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                3⤵
                                  PID:3256
                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                  3⤵
                                    PID:1000
                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                    3⤵
                                      PID:4620
                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                      3⤵
                                        PID:4808
                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                        3⤵
                                          PID:3296
                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                          3⤵
                                            PID:5716
                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                            3⤵
                                              PID:3080
                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                              3⤵
                                                PID:5524
                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                3⤵
                                                  PID:5640
                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                  3⤵
                                                    PID:1484
                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                    3⤵
                                                      PID:5836
                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                      3⤵
                                                        PID:3216
                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                        3⤵
                                                          PID:6016
                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                          3⤵
                                                            PID:5860
                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                            3⤵
                                                              PID:1760
                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                              3⤵
                                                                PID:432
                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                3⤵
                                                                  PID:3512
                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                  3⤵
                                                                    PID:4336
                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                    3⤵
                                                                      PID:1204
                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                      3⤵
                                                                        PID:5480
                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                        3⤵
                                                                          PID:1584
                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                          3⤵
                                                                            PID:5896
                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                            3⤵
                                                                              PID:4476
                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                              3⤵
                                                                                PID:1424
                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                3⤵
                                                                                  PID:4312
                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                  3⤵
                                                                                    PID:4192
                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                    3⤵
                                                                                      PID:1564
                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                      3⤵
                                                                                        PID:3244
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                        3⤵
                                                                                          PID:4844
                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                          3⤵
                                                                                            PID:3804
                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                            3⤵
                                                                                              PID:1068
                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                              3⤵
                                                                                                PID:6032
                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                3⤵
                                                                                                  PID:1744
                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                  3⤵
                                                                                                    PID:2468
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                    3⤵
                                                                                                      PID:2720
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                      3⤵
                                                                                                        PID:4452
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                        3⤵
                                                                                                          PID:4728
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                          3⤵
                                                                                                            PID:2872
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                            3⤵
                                                                                                              PID:2920
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                              3⤵
                                                                                                                PID:4964
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                3⤵
                                                                                                                  PID:1572
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                  3⤵
                                                                                                                    PID:4048
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                    3⤵
                                                                                                                      PID:984
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                      3⤵
                                                                                                                        PID:3188
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                        3⤵
                                                                                                                          PID:1856
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                          3⤵
                                                                                                                            PID:3496
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                            3⤵
                                                                                                                              PID:5984
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                              3⤵
                                                                                                                                PID:3648
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:5196
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:4044
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:3284
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:3028
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:2376
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:1480
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:4256
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:5524
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:5640
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5856
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3632
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:432
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3512
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1664
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6128
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:5428
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5608
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5472
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:964
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1836
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:5928
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5828
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4284
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:5892
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3904
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3944
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4192
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:4228
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1616
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3244
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4844
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5016
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:764
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:4592
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4172
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6060
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:3940
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1384
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4748
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3736
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1968
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4656
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1716
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3696
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:5380
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3048
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:2144
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2848
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:392
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4376
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3608
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4648
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:5980
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5224
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4596
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:3932
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1028
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:6024
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4020
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1160
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1676
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1376
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:5600
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1640
                                                                                                                                                                                                                                                                        • C:\Windows\wunjhwvnkhkgatndspngc.exe
                                                                                                                                                                                                                                                                          wunjhwvnkhkgatndspngc.exe .
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\wunjhwvnkhkgatndspngc.exe*."
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:4640
                                                                                                                                                                                                                                                                        • C:\Windows\aujbvgbpibasixnzk.exe
                                                                                                                                                                                                                                                                          aujbvgbpibasixnzk.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\wunjhwvnkhkgatndspngc.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\wunjhwvnkhkgatndspngc.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:1620
                                                                                                                                                                                                                                                                        • C:\Windows\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                          mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5872
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5792
                                                                                                                                                                                                                                                                        • C:\Windows\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                          ohzlgcoeattmdtkxji.exe .
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:5012
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\ohzlgcoeattmdtkxji.exe*."
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                        • C:\Windows\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                          fxoztozojbasixnzk.exe .
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\fxoztozojbasixnzk.exe*."
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                            • UAC bypass
                                                                                                                                                                                                                                                                            • Adds policy Run key to start application
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:5900
                                                                                                                                                                                                                                                                        • C:\Windows\jeuniuqfzttmdtkxjd.exe
                                                                                                                                                                                                                                                                          jeuniuqfzttmdtkxjd.exe .
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                          PID:3124
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\jeuniuqfzttmdtkxjd.exe*."
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3512
                                                                                                                                                                                                                                                                        • C:\Windows\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                          ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5912
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:5804
                                                                                                                                                                                                                                                                        • C:\Windows\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                          ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                                                                          • C:\Windows\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                            ztmzvsfwtnoiarjxkke.exe .
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                            PID:2680
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\ztmzvsfwtnoiarjxkke.exe*."
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                              • UAC bypass
                                                                                                                                                                                                                                                                              • Adds policy Run key to start application
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:3480
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hewrocarnjlgzrkznjgy.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hewrocarnjlgzrkznjgy.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2872
                                                                                                                                                                                                                                                                          • C:\Windows\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                            fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3188
                                                                                                                                                                                                                                                                            • C:\Windows\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                              ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2056
                                                                                                                                                                                                                                                                              • C:\Windows\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                                mhbpmkyqojlgzrkznojd.exe .
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\mhbpmkyqojlgzrkznojd.exe*."
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:540
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1044
                                                                                                                                                                                                                                                                              • C:\Windows\uqhbxkhxsnoiarjxkfb.exe
                                                                                                                                                                                                                                                                                uqhbxkhxsnoiarjxkfb.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                                                                              • C:\Windows\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                bxshfetmlhkgatndsuqla.exe .
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                PID:5712
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\bxshfetmlhkgatndsuqla.exe*."
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                  • UAC bypass
                                                                                                                                                                                                                                                                                  • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                                  PID:5468
                                                                                                                                                                                                                                                                              • C:\Windows\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                • C:\Windows\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                  ypfpicmauljapdsd.exe .
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                  PID:488
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\ypfpicmauljapdsd.exe*."
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                    • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                    • UAC bypass
                                                                                                                                                                                                                                                                                    • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                                                    PID:3444
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4600

                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1547.004

                                                                                                                                                                                                                                                                                      Hijack Execution Flow

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1574

                                                                                                                                                                                                                                                                                      Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1574.005

                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                                                      Winlogon Helper DLL

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1547.004

                                                                                                                                                                                                                                                                                      Hijack Execution Flow

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1574

                                                                                                                                                                                                                                                                                      Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1574.005

                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                      Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548

                                                                                                                                                                                                                                                                                      Bypass User Account Control

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1548.002

                                                                                                                                                                                                                                                                                      Hijack Execution Flow

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1574

                                                                                                                                                                                                                                                                                      Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1574.005

                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                      Disable or Modify Tools

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1562.001

                                                                                                                                                                                                                                                                                      Safe Mode Boot

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1562.009

                                                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                      hqubkk.exe
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\hqubkk.exe
                                                                                                                                                                                                                                                                                      • Size 700KB
                                                                                                                                                                                                                                                                                      • SHA256 6f514d42566370b318a1c34530b921d0927bf6013ed5ff3bd51abe22886330a8
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                      • Size 320KB
                                                                                                                                                                                                                                                                                      • SHA256 2b633f98d8360631d5f9dba8da1f44bcc0be7b7604051de30e01de46551d778e
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      gmnrxubbglwacdfdaflmqwtaa.kvz
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\gmnrxubbglwacdfdaflmqwtaa.kvz
                                                                                                                                                                                                                                                                                      • Size 280B
                                                                                                                                                                                                                                                                                      • SHA256 6754774ed1b91aca4f2694abc2640e3b24c5b818672dfdec7e9ea7cc502a21a6
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      lcoducufvlhwjvirzpgshygyjzplanzmvdtk.lck
                                                                                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\lcoducufvlhwjvirzpgshygyjzplanzmvdtk.lck
                                                                                                                                                                                                                                                                                      • Size 4KB
                                                                                                                                                                                                                                                                                      • SHA256 680ebcd53ba5d1c122e81e2f0296ef9c5342bcb012eeaf2c422033e969e619c0
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                      jeuniuqfzttmdtkxjd.exe
                                                                                                                                                                                                                                                                                      • Path C:\Windows\SysWOW64\jeuniuqfzttmdtkxjd.exe
                                                                                                                                                                                                                                                                                      • Size 1016KB
                                                                                                                                                                                                                                                                                      • SHA256 19bfc62f4162a8399e6c22f14721710d96007e027aaa8154e3d80bb725c360e4
                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                      Submit Download