Overview

overview

10

Static

static

3

tmpr34bnfug.exe

windows10-ltsc_2021-x64

10

tmpr34bnfug.exe

windows10-2004-x64

10

tmpr34bnfug.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 03:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpr34bnfug.exe
  • Size 524KB
  • Sample260602-d73vmsev3n
  • SHA256 f71aac19d5e1e24a5b983a37d068604ef8d1ece82b27eefccd52c8dfd3ce5426
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypykspapersistenceprivilege_escalationtrojanworm

Malware Config

Signatures

  • Family: Pykspa

    Pykspa is a worm spreads via Skype uses DGA and it's written in C++.

    wormpykspa
  • Detect Pykspa worm 2 IoCs
    worm
  • Modifies WinLogon for persistence 2 TTPs 10 IoCs
    persistence
  • UAC bypass 3 TTPs 22 IoCs
    defense_evasiontrojan
  • Adds policy Run key to start application 2 TTPs 55 IoCs
    persistence
  • Disables RegEdit via registry modification 8 IoCs
    defense_evasion
  • Executes dropped EXE 34 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 20 IoCs
    defense_evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 4 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • System policy modification 1 TTPs 60 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmpr34bnfug.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpr34bnfug.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\users\admin\appdata\local\temp\tmpr34bnfug.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1284
      • C:\Users\Admin\AppData\Local\Temp\jnygms.exe
        "C:\Users\Admin\AppData\Local\Temp\jnygms.exe" "-C:\Users\Admin\AppData\Local\Temp\vjewmckdtljapdsd.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:2972
      • C:\Users\Admin\AppData\Local\Temp\jnygms.exe
        "C:\Users\Admin\AppData\Local\Temp\jnygms.exe" "-C:\Users\Admin\AppData\Local\Temp\vjewmckdtljapdsd.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:2960
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\users\admin\appdata\local\temp\tmpr34bnfug.exe"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System policy modification
      PID:3492
  • C:\Windows\crngxoxribasixnzk.exe
    crngxoxribasixnzk.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1780
  • C:\Windows\wnlgzsdzsnoiarjxkhy.exe
    wnlgzsdzsnoiarjxkhy.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\wnlgzsdzsnoiarjxkhy.exe*."
      2⤵
      • Executes dropped EXE
      PID:556
  • C:\Windows\explorer.exe
    Explorer.exe
    1⤵
    • Modifies registry class
    PID:848
  • C:\Windows\vjewmckdtljapdsd.exe
    vjewmckdtljapdsd.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\vjewmckdtljapdsd.exe*."
      2⤵
      • Executes dropped EXE
      PID:4272
  • C:\Users\Admin\AppData\Local\Temp\yrrojerpkhkgatndsrkkh.exe
    C:\Users\Admin\AppData\Local\Temp\yrrojerpkhkgatndsrkkh.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4956
  • C:\Users\Admin\AppData\Local\Temp\lbyskcmhzttmdtkxjf.exe
    C:\Users\Admin\AppData\Local\Temp\lbyskcmhzttmdtkxjf.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1416
  • C:\Windows\yrrojerpkhkgatndsrkkh.exe
    yrrojerpkhkgatndsrkkh.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4268
  • C:\Windows\jbawqkwtnjlgzrkznldc.exe
    jbawqkwtnjlgzrkznldc.exe .
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
      "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\jbawqkwtnjlgzrkznldc.exe*."
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:3476
      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:324
      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
        3⤵
          PID:1784
        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
          3⤵
            PID:4412
          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
            3⤵
              PID:1112
            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
              3⤵
                PID:4696
              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                3⤵
                  PID:2108
                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                  3⤵
                    PID:5040
                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                    3⤵
                      PID:4180
                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                      3⤵
                        PID:2828
                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                        3⤵
                          PID:1272
                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                          3⤵
                            PID:1544
                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                            3⤵
                              PID:4320
                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                              3⤵
                                PID:4024
                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                3⤵
                                  PID:440
                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                  3⤵
                                    PID:1708
                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                    3⤵
                                      PID:2096
                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                      3⤵
                                        PID:1868
                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                        3⤵
                                          PID:4176
                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                          3⤵
                                            PID:2152
                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                            3⤵
                                              PID:2908
                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                              3⤵
                                                PID:2480
                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                3⤵
                                                  PID:2016
                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                  3⤵
                                                    PID:2440
                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                    3⤵
                                                      PID:4736
                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                      3⤵
                                                        PID:2184
                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                        3⤵
                                                          PID:2804
                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                          3⤵
                                                            PID:1496
                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                            3⤵
                                                              PID:2676
                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                              3⤵
                                                                PID:3224
                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                3⤵
                                                                  PID:2052
                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                  3⤵
                                                                    PID:3768
                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                    3⤵
                                                                      PID:2816
                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                      3⤵
                                                                        PID:3276
                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                        3⤵
                                                                          PID:3440
                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                          3⤵
                                                                            PID:5100
                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                            3⤵
                                                                              PID:3220
                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                              3⤵
                                                                                PID:3844
                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                3⤵
                                                                                  PID:4020
                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                  3⤵
                                                                                    PID:2648
                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                    3⤵
                                                                                      PID:556
                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                      3⤵
                                                                                        PID:4156
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                        3⤵
                                                                                          PID:1676
                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                          3⤵
                                                                                            PID:2532
                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                            3⤵
                                                                                              PID:1616
                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                              3⤵
                                                                                                PID:4900
                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                3⤵
                                                                                                  PID:2364
                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                  3⤵
                                                                                                    PID:760
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                    3⤵
                                                                                                      PID:3484
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                      3⤵
                                                                                                        PID:1856
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                        3⤵
                                                                                                          PID:3176
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                          3⤵
                                                                                                            PID:3972
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                            3⤵
                                                                                                              PID:912
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                              3⤵
                                                                                                                PID:4320
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                3⤵
                                                                                                                  PID:2788
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                  3⤵
                                                                                                                    PID:412
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                    3⤵
                                                                                                                      PID:2612
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                      3⤵
                                                                                                                        PID:1416
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                        3⤵
                                                                                                                          PID:4048
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                          3⤵
                                                                                                                            PID:1672
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                            3⤵
                                                                                                                              PID:1516
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                              3⤵
                                                                                                                                PID:1932
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:2172
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:3636
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:4840
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:4588
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:4148
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:3244
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:1664
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:324
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:1784
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4576
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3996
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:660
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4960
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4676
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2804
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2780
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1496
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:3224
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2052
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:3768
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1864
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1992
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4568
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:764
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:3704
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:900
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1292
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5104
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1104
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4692
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2176
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4172
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:5092
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3992
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4076
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:3696
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4252
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4176
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:740
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1580
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4840
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4148
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3244
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:2964
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4056
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1096
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:3316
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4508
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3480
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:2464
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4960
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:2872
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4712
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3224
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:2052
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:3768
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3052
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:764
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:3704
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1964
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:3904
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:4524
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:2832
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:556
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3420
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:4156
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mtzzis.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\mtzzis.exe" "-C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\wnlgzsdzsnoiarjxkhy.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\wnlgzsdzsnoiarjxkhy.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                    • C:\Windows\lbyskcmhzttmdtkxjf.exe
                                                                                                                                                                                                                                                                                      lbyskcmhzttmdtkxjf.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2908
                                                                                                                                                                                                                                                                                    • C:\Windows\yrrojerpkhkgatndsrkkh.exe
                                                                                                                                                                                                                                                                                      yrrojerpkhkgatndsrkkh.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:2672
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\yrrojerpkhkgatndsrkkh.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jbawqkwtnjlgzrkznldc.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jbawqkwtnjlgzrkznldc.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                    • C:\Windows\lbyskcmhzttmdtkxjf.exe
                                                                                                                                                                                                                                                                                      lbyskcmhzttmdtkxjf.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:2888
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\lbyskcmhzttmdtkxjf.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:736
                                                                                                                                                                                                                                                                                    • C:\Windows\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                                      ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4068
                                                                                                                                                                                                                                                                                    • C:\Windows\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                                      ohzlgcoeattmdtkxji.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:2180
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\ohzlgcoeattmdtkxji.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:4244
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3992
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2660
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\crngxoxribasixnzk.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\crngxoxribasixnzk.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1776
                                                                                                                                                                                                                                                                                    • C:\Windows\crngxoxribasixnzk.exe
                                                                                                                                                                                                                                                                                      crngxoxribasixnzk.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:5020
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\crngxoxribasixnzk.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:2532
                                                                                                                                                                                                                                                                                    • C:\Windows\jbawqkwtnjlgzrkznldc.exe
                                                                                                                                                                                                                                                                                      jbawqkwtnjlgzrkznldc.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5084
                                                                                                                                                                                                                                                                                    • C:\Windows\vjewmckdtljapdsd.exe
                                                                                                                                                                                                                                                                                      vjewmckdtljapdsd.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                                    • C:\Windows\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                                      mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                                                                                    • C:\Windows\mhbpmkyqojlgzrkznojd.exe
                                                                                                                                                                                                                                                                                      mhbpmkyqojlgzrkznojd.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:4124
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\mhbpmkyqojlgzrkznojd.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:1244
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2856
                                                                                                                                                                                                                                                                                    • C:\Windows\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                      bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                    • C:\Windows\wnlgzsdzsnoiarjxkhy.exe
                                                                                                                                                                                                                                                                                      wnlgzsdzsnoiarjxkhy.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:3992
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\vjewmckdtljapdsd.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\vjewmckdtljapdsd.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4064
                                                                                                                                                                                                                                                                                    • C:\Windows\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                      ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:4804
                                                                                                                                                                                                                                                                                    • C:\Windows\ypfpicmauljapdsd.exe
                                                                                                                                                                                                                                                                                      ypfpicmauljapdsd.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:656
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\ypfpicmauljapdsd.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:2304
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                    • C:\Windows\bxshfetmlhkgatndsuqla.exe
                                                                                                                                                                                                                                                                                      bxshfetmlhkgatndsuqla.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:4732
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\bxshfetmlhkgatndsuqla.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:2708
                                                                                                                                                                                                                                                                                    • C:\Windows\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                      fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                    • C:\Windows\ztmzvsfwtnoiarjxkke.exe
                                                                                                                                                                                                                                                                                      ztmzvsfwtnoiarjxkke.exe .
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:1760
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\ztmzvsfwtnoiarjxkke.exe*."
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                        • UAC bypass
                                                                                                                                                                                                                                                                                        • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                                        PID:4060
                                                                                                                                                                                                                                                                                    • C:\Windows\ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                                      ohzlgcoeattmdtkxji.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:4364
                                                                                                                                                                                                                                                                                      • C:\Windows\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                        fxoztozojbasixnzk.exe .
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:1184
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe" "c:\windows\fxoztozojbasixnzk.exe*."
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Modifies WinLogon for persistence
                                                                                                                                                                                                                                                                                          • UAC bypass
                                                                                                                                                                                                                                                                                          • Adds policy Run key to start application
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\fxoztozojbasixnzk.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:1520

                                                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                                                                            Replication Through Removable Media

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1091

                                                                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                                                                            Hijack Execution Flow

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1574

                                                                                                                                                                                                                                                                                            Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1574.005

                                                                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                            3
                                                                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                                                                            Hijack Execution Flow

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1574

                                                                                                                                                                                                                                                                                            Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1574.005

                                                                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1548

                                                                                                                                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1548.002

                                                                                                                                                                                                                                                                                            Hijack Execution Flow

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1574

                                                                                                                                                                                                                                                                                            Executable Installer File Permissions Weakness

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1574.005

                                                                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                                                                            Safe Mode Boot

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1562.009

                                                                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1614

                                                                                                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                                                                            Replication Through Removable Media

                                                                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                                                                            T1091

                                                                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                            ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Path C:\Program Files (x86)\ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Size 272B
                                                                                                                                                                                                                                                                                            • SHA256 d9a53f849360743fd3e7d48f244a7cf3fc05356cf9fa04f1b1dcbfb5c4091ed5
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Path C:\Program Files (x86)\ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Size 272B
                                                                                                                                                                                                                                                                                            • SHA256 2036ad685830249c14fb6ad270e1b68a64a2abd86e65332fa08897f60959439f
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Path C:\Program Files (x86)\ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Size 272B
                                                                                                                                                                                                                                                                                            • SHA256 b9dff92ae05017a599548894e6fe4ed762a3bdf44bb6ded3ff611298c2a46ff6
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            jnygms.exe
                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\jnygms.exe
                                                                                                                                                                                                                                                                                            • Size 696KB
                                                                                                                                                                                                                                                                                            • SHA256 b0e48f9813327a29a02826db36070286280846318918fc304c1c494467dceeb2
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\slxhqaglcvh.exe
                                                                                                                                                                                                                                                                                            • Size 320KB
                                                                                                                                                                                                                                                                                            • SHA256 0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\ddkoqsmrtxhkllmjfllswyau.bfp
                                                                                                                                                                                                                                                                                            • Size 272B
                                                                                                                                                                                                                                                                                            • SHA256 7b78c7f2abbfd63e57f0626c2abd9745d582de6ba3137155880c901bbfc1a3ca
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            mxperejzmbwkwhtbizkcrerwmzojxjugovm.per
                                                                                                                                                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\mxperejzmbwkwhtbizkcrerwmzojxjugovm.per
                                                                                                                                                                                                                                                                                            • Size 3KB
                                                                                                                                                                                                                                                                                            • SHA256 bc4ded8727df21fa318d38f426b71f8d22ac0a85c1919ffbe22b2557683f7309
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            lbyskcmhzttmdtkxjf.exe
                                                                                                                                                                                                                                                                                            • Path C:\Windows\SysWOW64\lbyskcmhzttmdtkxjf.exe
                                                                                                                                                                                                                                                                                            • Size 524KB
                                                                                                                                                                                                                                                                                            • SHA256 f71aac19d5e1e24a5b983a37d068604ef8d1ece82b27eefccd52c8dfd3ce5426
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                            Submit Download

                                                                                                                                                                                                                                                                                            cjxirabnw.bat
                                                                                                                                                                                                                                                                                            • Path C:\cjxirabnw.bat
                                                                                                                                                                                                                                                                                            • Size 556KB
                                                                                                                                                                                                                                                                                            • SHA256 9edb7374ed9fcfe985c26a5ee347c73e0e13fc70744c3b2101d8740cc94e1ee8
                                                                                                                                                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                            Submit Download