92f6a872afe67814f0d2cc6958c7bf8110c056033842bd81c26bc228896dbe92

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
13s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/09/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inputlock.exe
Size 135KB
Sample260922-zzdfnsff33
SHA256 92f6a872afe67814f0d2cc6958c7bf8110c056033842bd81c26bc228896dbe92
MD5 3bdf73de46052c86be6e7d73ac41f954
SHA1 365777571eca187c207cecb62514e24e9ad3bf37
SHA512 da4ec58f0326aa668b59d25c4788ba1030ee4120f44591bb7b047a5238323a1cdad0f7c365f6a9c9ee174d753b33a05c40217c0e726db5e9ed9f17dd72adf8ba
SSDEEP 3072:a/BqYxF3MmGZMIflvXaGQdwMGbInRSo7dRogehBIZtye4OD:a/BqYxF3MmGeKPvQD1RS2dJebepD
TLSH
T12ED32957B3E530F8E077C67AC8914941E773B8390B619BEF07A046665E236E09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 56 IoCs

pid	Process
2624	msvc.exe
5520	hf20rh40.exe
4292	inrnf8cl.exe
5068	bjhv39vq.exe
444	a7tyqr5m.exe
4756	1so7s24m.exe
4888	9sva76m0.exe
2128	mzsmlncb.exe
5544	k4q0nc7r.exe
5312	5iylo657.exe
3748	noi8lpji.exe
3412	rchbn4ta.exe
1720	sddyoq0m.exe
5200	0ckzqbss.exe
5580	zp1ve8fm.exe
4872	tm425acz.exe
4520	w1wmlsa1.exe
5672	92y5j8nc.exe
5604	ru99l3hi.exe
2172	9b50dpmk.exe
1088	kgirssod.exe
1844	184soys1.exe
5232	lopxjrkl.exe
484	2z3pke89.exe
2932	010ej6ww.exe
2216	p2vp6gd8.exe
5420	z1rv5qci.exe
488	3yb2ss8w.exe
3736	2hj73vsk.exe
5948	a3uighrj.exe
3596	inputlock.exe
1260	247j6d2r.exe
1496	un9aw99h.exe
4628	5iylo657.exe
5932	0sgdmw06.exe
5540	inrnf8cl.exe
4640	noi8lpji.exe
3252	wweb2l1e.exe
2408	0alvg2r1.exe
3356	6rdxvs9z.exe
5440	zp1ve8fm.exe
5000	f3dykqig.exe
3228	w1wmlsa1.exe
4244	msvc.exe
2924	msvc.exe
3592	x7kuyt09.exe
924	msvc.exe
1000	msvc.exe
932	msvc.exe
3396	cfhv4ft3.exe
2400	msvc.exe
3300	1mwis6s1.exe
1980	msvc.exe
4356	msvc.exe
5692	ku00zhvf.exe
3780	h01kqxib.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-1d80oe6g = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\p2vp6gd8.exe\""	p2vp6gd8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-yn2b6jpp = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\bjhv39vq.exe\""	bjhv39vq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-z1d6d73d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\mzsmlncb.exe\""	mzsmlncb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-58by7rfn = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\0ckzqbss.exe\""	0ckzqbss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-mn7z82dk = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\92y5j8nc.exe\""	92y5j8nc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-j8tbscw2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\9b50dpmk.exe\""	9b50dpmk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-2bxtxhoo = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\3yb2ss8w.exe\""	3yb2ss8w.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	noi8lpji.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-lftjzkso = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\1so7s24m.exe\""	1so7s24m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-gd33lg65 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\2hj73vsk.exe\""	2hj73vsk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-1helvylr = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\6rdxvs9z.exe\""	6rdxvs9z.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-tvmv23ei = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\f3dykqig.exe\""	f3dykqig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	zp1ve8fm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	w1wmlsa1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-6hoz0i92 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\x7kuyt09.exe\""	x7kuyt09.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	inputlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-hhx0iyfy = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\inrnf8cl.exe\""	inrnf8cl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-664gw02j = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\9sva76m0.exe\""	9sva76m0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-yil4jp78 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\k4q0nc7r.exe\""	k4q0nc7r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-qxavh36k = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\184soys1.exe\""	184soys1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-1ldgjac3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\a7tyqr5m.exe\""	a7tyqr5m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-gvuaipq1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\zp1ve8fm.exe\""	zp1ve8fm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-5pldtuxh = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\z1rv5qci.exe\""	z1rv5qci.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-nc20nme1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\a3uighrj.exe\""	a3uighrj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-7z5xeocb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\0sgdmw06.exe\""	0sgdmw06.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-dn5tb9ml = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\wweb2l1e.exe\""	wweb2l1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	inputlock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-vb6immvx = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\2z3pke89.exe\""	2z3pke89.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-nskqv5f8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\hf20rh40.exe\""	hf20rh40.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-qg2uo7d5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\w1wmlsa1.exe\""	w1wmlsa1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-fvb1frlw = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\ru99l3hi.exe\""	ru99l3hi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-uv3acopk = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\247j6d2r.exe\""	247j6d2r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-ei2trex0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\0alvg2r1.exe\""	0alvg2r1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	5iylo657.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\inputlock = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\inputlock-seed\\inputlock.exe\""	inrnf8cl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-n6h6ll4w = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\rchbn4ta.exe\""	rchbn4ta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-7gx8gggs = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\sddyoq0m.exe\""	sddyoq0m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-ri52765a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-a4sikmrc = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\noi8lpji.exe\""	noi8lpji.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-xnj5q5q1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-xjfzjrk0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\tm425acz.exe\""	tm425acz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-dl49zeqo = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\010ej6ww.exe\""	010ej6ww.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-g7d1bul3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-0zjewhec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-y3w1ahz1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-9bai2dhu = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\5iylo657.exe\""	5iylo657.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-mwvde9j3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\kgirssod.exe\""	kgirssod.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-wj72np82 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\lopxjrkl.exe\""	lopxjrkl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-z5ph8vgt = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\un9aw99h.exe\""	un9aw99h.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-iiryk42a = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc.exe\""	msvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000\Software\Microsoft\Windows\CurrentVersion\Run\svc-pgefapwo = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\msvc-seed\\cfhv4ft3.exe\""	cfhv4ft3.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: 33	4140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4140	AUDIODG.EXE
Token: 33	4888	9sva76m0.exe
Token: SeIncBasePriorityPrivilege	4888	9sva76m0.exe
Token: 33	5544	k4q0nc7r.exe
Token: SeIncBasePriorityPrivilege	5544	k4q0nc7r.exe
Token: 33	5520	hf20rh40.exe
Token: SeIncBasePriorityPrivilege	5520	hf20rh40.exe
Token: 33	444	a7tyqr5m.exe
Token: SeIncBasePriorityPrivilege	444	a7tyqr5m.exe
Token: 33	2624	msvc.exe
Token: SeIncBasePriorityPrivilege	2624	msvc.exe
Token: 33	5068	bjhv39vq.exe
Token: SeIncBasePriorityPrivilege	5068	bjhv39vq.exe
Token: 33	2128	mzsmlncb.exe
Token: SeIncBasePriorityPrivilege	2128	mzsmlncb.exe
Token: 33	1720	sddyoq0m.exe
Token: SeIncBasePriorityPrivilege	1720	sddyoq0m.exe
Token: 33	4756	1so7s24m.exe
Token: SeIncBasePriorityPrivilege	4756	1so7s24m.exe
Token: 33	4292	inrnf8cl.exe
Token: SeIncBasePriorityPrivilege	4292	inrnf8cl.exe
Token: 33	3412	rchbn4ta.exe
Token: SeIncBasePriorityPrivilege	3412	rchbn4ta.exe
Token: 33	5312	5iylo657.exe
Token: SeIncBasePriorityPrivilege	5312	5iylo657.exe
Token: 33	3748	noi8lpji.exe
Token: SeIncBasePriorityPrivilege	3748	noi8lpji.exe
Token: 33	5200	0ckzqbss.exe
Token: SeIncBasePriorityPrivilege	5200	0ckzqbss.exe
Token: 33	4872	tm425acz.exe
Token: SeIncBasePriorityPrivilege	4872	tm425acz.exe
Token: 33	5580	zp1ve8fm.exe
Token: SeIncBasePriorityPrivilege	5580	zp1ve8fm.exe
Token: 33	4520	w1wmlsa1.exe
Token: SeIncBasePriorityPrivilege	4520	w1wmlsa1.exe
Token: 33	5672	92y5j8nc.exe
Token: SeIncBasePriorityPrivilege	5672	92y5j8nc.exe
Token: 33	5604	ru99l3hi.exe
Token: SeIncBasePriorityPrivilege	5604	ru99l3hi.exe
Token: 33	1088	kgirssod.exe
Token: SeIncBasePriorityPrivilege	1088	kgirssod.exe
Token: 33	2172	9b50dpmk.exe
Token: SeIncBasePriorityPrivilege	2172	9b50dpmk.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
6004	inputlock.exe
6004	inputlock.exe
4640	noi8lpji.exe
4640	noi8lpji.exe
5440	zp1ve8fm.exe
5440	zp1ve8fm.exe
4628	5iylo657.exe
4628	5iylo657.exe
5540	inrnf8cl.exe
5540	inrnf8cl.exe
3228	w1wmlsa1.exe
3228	w1wmlsa1.exe
4244	msvc.exe
4244	msvc.exe
3596	inputlock.exe
3596	inputlock.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 2624	6004	inputlock.exe	80
PID 2624 wrote to memory of 5520	2624	msvc.exe	81
PID 5520 wrote to memory of 4292	5520	hf20rh40.exe	83
PID 4292 wrote to memory of 5068	4292	inrnf8cl.exe	84
PID 5068 wrote to memory of 444	5068	bjhv39vq.exe	85
PID 444 wrote to memory of 4756	444	a7tyqr5m.exe	86
PID 4756 wrote to memory of 4888	4756	1so7s24m.exe	87
PID 4888 wrote to memory of 2128	4888	9sva76m0.exe	88
PID 2128 wrote to memory of 5544	2128	mzsmlncb.exe	89
PID 5544 wrote to memory of 5312	5544	k4q0nc7r.exe	90
PID 5312 wrote to memory of 3748	5312	5iylo657.exe	99
PID 3748 wrote to memory of 3412	3748	noi8lpji.exe	102
PID 3412 wrote to memory of 1720	3412	rchbn4ta.exe	104
PID 1720 wrote to memory of 5200	1720	sddyoq0m.exe	106
PID 5200 wrote to memory of 5580	5200	0ckzqbss.exe	109
PID 5580 wrote to memory of 4872	5580	zp1ve8fm.exe	110
PID 4872 wrote to memory of 4520	4872	tm425acz.exe	112
PID 4520 wrote to memory of 5672	4520	w1wmlsa1.exe	113
PID 5672 wrote to memory of 5604	5672	92y5j8nc.exe	114
PID 5604 wrote to memory of 2172	5604	ru99l3hi.exe	120
PID 2172 wrote to memory of 1088	2172	9b50dpmk.exe	121
PID 1088 wrote to memory of 1844	1088	kgirssod.exe	122
PID 1844 wrote to memory of 5232	1844	184soys1.exe	125
PID 5232 wrote to memory of 484	5232	lopxjrkl.exe	126
PID 484 wrote to memory of 2932	484	2z3pke89.exe	127
PID 2932 wrote to memory of 2216	2932	010ej6ww.exe	131
PID 2216 wrote to memory of 5420	2216	p2vp6gd8.exe	132
PID 5420 wrote to memory of 488	5420	z1rv5qci.exe	133
PID 488 wrote to memory of 3736	488	3yb2ss8w.exe	134
PID 3736 wrote to memory of 5948	3736	2hj73vsk.exe	135
PID 5948 wrote to memory of 1260	5948	a3uighrj.exe	137
PID 1260 wrote to memory of 1496	1260	247j6d2r.exe	138
PID 1496 wrote to memory of 5932	1496	un9aw99h.exe	144
PID 5932 wrote to memory of 3252	5932	0sgdmw06.exe	149
PID 3252 wrote to memory of 2408	3252	wweb2l1e.exe	150
PID 2408 wrote to memory of 3356	2408	0alvg2r1.exe	151
PID 3356 wrote to memory of 5000	3356	6rdxvs9z.exe	152
PID 4640 wrote to memory of 2924	4640	noi8lpji.exe	156
PID 5000 wrote to memory of 3592	5000	f3dykqig.exe	157
PID 4628 wrote to memory of 924	4628	5iylo657.exe	163
PID 5540 wrote to memory of 1000	5540	inrnf8cl.exe	164
PID 3228 wrote to memory of 932	3228	w1wmlsa1.exe	165
PID 2924 wrote to memory of 3396	2924	msvc.exe	166
PID 4244 wrote to memory of 2400	4244	msvc.exe	167
PID 3592 wrote to memory of 3300	3592	x7kuyt09.exe	168
PID 3596 wrote to memory of 1980	3596	inputlock.exe	171
PID 5440 wrote to memory of 4356	5440	zp1ve8fm.exe	162
PID 924 wrote to memory of 5692	924	msvc.exe	172
PID 932 wrote to memory of 3780	932	msvc.exe	174
PID 1000 wrote to memory of 1668	1000	msvc.exe	173

C:\Users\Admin\AppData\Local\Temp\inputlock.exe
"C:\Users\Admin\AppData\Local\Temp\inputlock.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\hf20rh40.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\hf20rh40.exe" msvc-burn
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\inrnf8cl.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\inrnf8cl.exe" msvc-burn
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjhv39vq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjhv39vq.exe" msvc-burn
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\a7tyqr5m.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\a7tyqr5m.exe" msvc-burn
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\1so7s24m.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\1so7s24m.exe" msvc-burn
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\9sva76m0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\9sva76m0.exe" msvc-burn
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\mzsmlncb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\mzsmlncb.exe" msvc-burn
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\k4q0nc7r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\k4q0nc7r.exe" msvc-burn
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\5iylo657.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\5iylo657.exe" msvc-burn
        11⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\noi8lpji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\noi8lpji.exe" msvc-burn
        12⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\rchbn4ta.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\rchbn4ta.exe" msvc-burn
        13⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\sddyoq0m.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\sddyoq0m.exe" msvc-burn
        14⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\0ckzqbss.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\0ckzqbss.exe" msvc-burn
        15⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\zp1ve8fm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\zp1ve8fm.exe" msvc-burn
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\tm425acz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\tm425acz.exe" msvc-burn
        17⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\w1wmlsa1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\w1wmlsa1.exe" msvc-burn
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\92y5j8nc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\92y5j8nc.exe" msvc-burn
        19⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\ru99l3hi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ru99l3hi.exe" msvc-burn
        20⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\9b50dpmk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\9b50dpmk.exe" msvc-burn
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\kgirssod.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\kgirssod.exe" msvc-burn
        22⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\184soys1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\184soys1.exe" msvc-burn
        23⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\lopxjrkl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\lopxjrkl.exe" msvc-burn
        24⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\2z3pke89.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\2z3pke89.exe" msvc-burn
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\010ej6ww.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\010ej6ww.exe" msvc-burn
        26⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\p2vp6gd8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\p2vp6gd8.exe" msvc-burn
        27⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\z1rv5qci.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\z1rv5qci.exe" msvc-burn
        28⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\3yb2ss8w.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\3yb2ss8w.exe" msvc-burn
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:488
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\2hj73vsk.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\2hj73vsk.exe" msvc-burn
        30⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\a3uighrj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\a3uighrj.exe" msvc-burn
        31⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\247j6d2r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\247j6d2r.exe" msvc-burn
        32⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\un9aw99h.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\un9aw99h.exe" msvc-burn
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\0sgdmw06.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\0sgdmw06.exe" msvc-burn
        34⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\wweb2l1e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\wweb2l1e.exe" msvc-burn
        35⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\0alvg2r1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\0alvg2r1.exe" msvc-burn
        36⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\6rdxvs9z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\6rdxvs9z.exe" msvc-burn
        37⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\f3dykqig.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\f3dykqig.exe" msvc-burn
        38⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\x7kuyt09.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\x7kuyt09.exe" msvc-burn
        39⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\1mwis6s1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\1mwis6s1.exe" msvc-burn
        40⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\laj4vyf5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\laj4vyf5.exe" msvc-burn
        41⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\rfpqxljh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\rfpqxljh.exe" msvc-burn
        42⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\xpp2http.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\xpp2http.exe" msvc-burn
        43⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\78680flo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\78680flo.exe" msvc-burn
        44⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\0fcv8u06.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\0fcv8u06.exe" msvc-burn
        45⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\n8bmtwtg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\n8bmtwtg.exe" msvc-burn
        46⤵
        
        PID:7568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004D4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4140

C:\Users\Admin\AppData\Local\Temp\inputlock-seed\inputlock.exe
"C:\Users\Admin\AppData\Local\Temp\inputlock-seed\inputlock.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\hksgjj7h.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\hksgjj7h.exe" msvc-burn
    3⤵
    PID:904
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\37s9nxuq.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\37s9nxuq.exe" msvc-burn
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\uh6s2fzo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\uh6s2fzo.exe" msvc-burn
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\p7r29lcj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\p7r29lcj.exe" msvc-burn
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\ts5xvx88.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ts5xvx88.exe" msvc-burn
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\mqt7sbrm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\mqt7sbrm.exe" msvc-burn
        8⤵
        
        PID:7652

C:\Users\Admin\AppData\Local\Temp\msvc-seed\5iylo657.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\5iylo657.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\ku00zhvf.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ku00zhvf.exe" msvc-burn
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\vqb87kss.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\vqb87kss.exe" msvc-burn
      4⤵
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\5v7athf7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\5v7athf7.exe" msvc-burn
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\cz2w0lui.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\cz2w0lui.exe" msvc-burn
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\4ai24v4u.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\4ai24v4u.exe" msvc-burn
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\acqpw0gy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\acqpw0gy.exe" msvc-burn
        8⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\7cdtw3op.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\7cdtw3op.exe" msvc-burn
        9⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\ybsgt7bq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ybsgt7bq.exe" msvc-burn
        10⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\xlrcs2f9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\xlrcs2f9.exe" msvc-burn
        11⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\d3ymgi7y.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\d3ymgi7y.exe" msvc-burn
        12⤵
        
        PID:1272
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\p5vj9up2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\p5vj9up2.exe" msvc-burn
        13⤵
        
        PID:7676

C:\Users\Admin\AppData\Local\Temp\msvc-seed\inrnf8cl.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\inrnf8cl.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5540
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\k733cdxz.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\k733cdxz.exe" msvc-burn
    3⤵
    PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\lp3n4yc3.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\lp3n4yc3.exe" msvc-burn
      4⤵
      PID:756
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\qyiaihqo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\qyiaihqo.exe" msvc-burn
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\46c3tue6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\46c3tue6.exe" msvc-burn
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\44ov64x8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\44ov64x8.exe" msvc-burn
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\f2vznacj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\f2vznacj.exe" msvc-burn
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\5h1t0o8c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\5h1t0o8c.exe" msvc-burn
        9⤵
        
        PID:7416

C:\Users\Admin\AppData\Local\Temp\msvc-seed\noi8lpji.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\noi8lpji.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\cfhv4ft3.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\cfhv4ft3.exe" msvc-burn
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3396
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\h7yded7j.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\h7yded7j.exe" msvc-burn
      4⤵
      PID:940
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\q91thvqa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\q91thvqa.exe" msvc-burn
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\de3q1dw0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\de3q1dw0.exe" msvc-burn
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\v1q1ia1p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\v1q1ia1p.exe" msvc-burn
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\eqk6dqfs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\eqk6dqfs.exe" msvc-burn
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjyci1p1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjyci1p1.exe" msvc-burn
        9⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\fg793v4b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\fg793v4b.exe" msvc-burn
        10⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\o3fh3g8s.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\o3fh3g8s.exe" msvc-burn
        11⤵
        
        PID:7520

C:\Users\Admin\AppData\Local\Temp\msvc-seed\zp1ve8fm.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\zp1ve8fm.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\jc3zxcel.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\jc3zxcel.exe" msvc-burn
    3⤵
    PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\ykgss592.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ykgss592.exe" msvc-burn
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\9ucovft6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\9ucovft6.exe" msvc-burn
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\w167wn8j.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\w167wn8j.exe" msvc-burn
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\bpp150zz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\bpp150zz.exe" msvc-burn
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\swbkjtmb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\swbkjtmb.exe" msvc-burn
        8⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\gq5sr2ku.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\gq5sr2ku.exe" msvc-burn
        9⤵
        
        PID:7412

C:\Users\Admin\AppData\Local\Temp\msvc-seed\w1wmlsa1.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\w1wmlsa1.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\h01kqxib.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\h01kqxib.exe" msvc-burn
    3⤵
    - Executes dropped EXE
    PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\olfbj2nv.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\olfbj2nv.exe" msvc-burn
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\b41vhz5t.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\b41vhz5t.exe" msvc-burn
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\tiputz4e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\tiputz4e.exe" msvc-burn
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\pb9t3nsa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\pb9t3nsa.exe" msvc-burn
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\i8bqlfcq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\i8bqlfcq.exe" msvc-burn
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\j7uzq22r.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\j7uzq22r.exe" msvc-burn
        9⤵
        
        PID:7528

C:\Users\Admin\AppData\Local\Temp\msvc.exe
"C:\Users\Admin\AppData\Local\Temp\msvc.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  - Executes dropped EXE
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\jhk61abc.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\jhk61abc.exe" msvc-burn
    3⤵
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\igavhjgh.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\igavhjgh.exe" msvc-burn
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\y12iqk0a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\y12iqk0a.exe" msvc-burn
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\kq49r7su.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\kq49r7su.exe" msvc-burn
        6⤵
        
        PID:7544

C:\Users\Admin\AppData\Local\Temp\msvc-seed\mzsmlncb.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\mzsmlncb.exe"
1⤵
PID:7104

C:\Users\Admin\AppData\Local\Temp\msvc-seed\9sva76m0.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\9sva76m0.exe"
1⤵
PID:7184

C:\Users\Admin\AppData\Local\Temp\msvc-seed\1so7s24m.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\1so7s24m.exe"
1⤵
PID:7364

C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjhv39vq.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjhv39vq.exe"
1⤵
PID:7356
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:8864
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\v0u9teu4.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\v0u9teu4.exe" msvc-burn
    3⤵
    PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\c1s0b6dq.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\c1s0b6dq.exe" msvc-burn
      4⤵
      PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\f27b7j7b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\f27b7j7b.exe" msvc-burn
        5⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\yeuwqd1z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\yeuwqd1z.exe" msvc-burn
        6⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\8721g81p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\8721g81p.exe" msvc-burn
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\dmumzxg4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\dmumzxg4.exe" msvc-burn
        8⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\nbscpbn5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\nbscpbn5.exe" msvc-burn
        9⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\tovubl8x.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\tovubl8x.exe" msvc-burn
        10⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\4rztu3ih.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\4rztu3ih.exe" msvc-burn
        11⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\6lnndmef.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\6lnndmef.exe" msvc-burn
        12⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\yhh0nq2v.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\yhh0nq2v.exe" msvc-burn
        13⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\rxd6a3rc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\rxd6a3rc.exe" msvc-burn
        14⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\ennv02h5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ennv02h5.exe" msvc-burn
        15⤵
        
        PID:8524

C:\Users\Admin\AppData\Local\Temp\msvc-seed\k4q0nc7r.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\k4q0nc7r.exe"
1⤵
PID:7860

C:\Users\Admin\AppData\Local\Temp\msvc-seed\010ej6ww.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\010ej6ww.exe"
1⤵
PID:7880
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:6584

C:\Users\Admin\AppData\Local\Temp\msvc-seed\a7tyqr5m.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\a7tyqr5m.exe"
1⤵
PID:7528

C:\Users\Admin\AppData\Local\Temp\msvc-seed\hf20rh40.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\hf20rh40.exe"
1⤵
PID:7596

C:\Users\Admin\AppData\Local\Temp\msvc-seed\ru99l3hi.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\ru99l3hi.exe"
1⤵
PID:6568
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:9040

C:\Users\Admin\AppData\Local\Temp\msvc-seed\tm425acz.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\tm425acz.exe"
1⤵
PID:6796

C:\Users\Admin\AppData\Local\Temp\msvc-seed\lopxjrkl.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\lopxjrkl.exe"
1⤵
PID:6616
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:6820
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\80me2tgj.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\80me2tgj.exe" msvc-burn
    3⤵
    PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\rytmwoy3.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\rytmwoy3.exe" msvc-burn
      4⤵
      PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\bn9a5q4m.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\bn9a5q4m.exe" msvc-burn
        5⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\msvc-seed\st3p45oy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\st3p45oy.exe" msvc-burn
        6⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\0gbnzkln.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\0gbnzkln.exe" msvc-burn
        7⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\o2clo96e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\o2clo96e.exe" msvc-burn
        8⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\inh98e8b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\inh98e8b.exe" msvc-burn
        9⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\lc4ngr5q.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\lc4ngr5q.exe" msvc-burn
        10⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\7sipcash.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\7sipcash.exe" msvc-burn
        11⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\msvc-seed\z3xzl1oa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\z3xzl1oa.exe" msvc-burn
        12⤵
        
        PID:9776

C:\Users\Admin\AppData\Local\Temp\msvc-seed\9b50dpmk.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\9b50dpmk.exe"
1⤵
PID:8056

C:\Users\Admin\AppData\Local\Temp\msvc-seed\rchbn4ta.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\rchbn4ta.exe"
1⤵
PID:8064

C:\Users\Admin\AppData\Local\Temp\msvc-seed\184soys1.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\184soys1.exe"
1⤵
PID:7900
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:6828
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\7h3gr87c.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\7h3gr87c.exe" msvc-burn
    3⤵
    PID:8632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:7960

C:\Users\Admin\AppData\Local\Temp\msvc-seed\3yb2ss8w.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\3yb2ss8w.exe"
1⤵
PID:7848

C:\Users\Admin\AppData\Local\Temp\msvc-seed\wweb2l1e.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\wweb2l1e.exe"
1⤵
PID:7728

C:\Users\Admin\AppData\Local\Temp\msvc-seed\rfpqxljh.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\rfpqxljh.exe"
1⤵
PID:7172
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:8032

C:\Users\Admin\AppData\Local\Temp\msvc-seed\a3uighrj.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\a3uighrj.exe"
1⤵
PID:6744
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:8608

C:\Users\Admin\AppData\Local\Temp\msvc-seed\kgirssod.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\kgirssod.exe"
1⤵
PID:5168

C:\Users\Admin\AppData\Local\Temp\msvc-seed\2z3pke89.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\2z3pke89.exe"
1⤵
PID:6868
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:9632
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\m84jdhx7.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\m84jdhx7.exe" msvc-burn
    3⤵
    PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\m3up858v.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\m3up858v.exe" msvc-burn
      4⤵
      PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\ut3xx8su.exe
        
        "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ut3xx8su.exe" msvc-burn
        5⤵
        
        PID:9796

C:\Users\Admin\AppData\Local\Temp\msvc-seed\sddyoq0m.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\sddyoq0m.exe"
1⤵
PID:1124
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:7256
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\hf6a1pqm.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\hf6a1pqm.exe" msvc-burn
    3⤵
    PID:9240

C:\Users\Admin\AppData\Local\Temp\msvc-seed\2hj73vsk.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\2hj73vsk.exe"
1⤵
PID:6364
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:8056
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\4itmtj4c.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\4itmtj4c.exe" msvc-burn
    3⤵
    PID:7004

C:\Users\Admin\AppData\Local\Temp\msvc-seed\z1rv5qci.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\z1rv5qci.exe"
1⤵
PID:5720

C:\Users\Admin\AppData\Local\Temp\msvc-seed\p2vp6gd8.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\p2vp6gd8.exe"
1⤵
PID:7964

C:\Users\Admin\AppData\Local\Temp\msvc-seed\0sgdmw06.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\0sgdmw06.exe"
1⤵
PID:6740

C:\Users\Admin\AppData\Local\Temp\msvc-seed\ku00zhvf.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\ku00zhvf.exe"
1⤵
PID:3664

C:\Users\Admin\AppData\Local\Temp\msvc-seed\un9aw99h.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\un9aw99h.exe"
1⤵
PID:7176

C:\Users\Admin\AppData\Local\Temp\msvc-seed\0alvg2r1.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\0alvg2r1.exe"
1⤵
PID:2444
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:5576

C:\Users\Admin\AppData\Local\Temp\msvc-seed\k733cdxz.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\k733cdxz.exe"
1⤵
PID:8588
- C:\Users\Admin\AppData\Local\Temp\msvc.exe
  "C:\Users\Admin\AppData\Local\Temp\\msvc.exe" msvc-burn
  2⤵
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\msvc-seed\55t0pf37.exe
    "C:\Users\Admin\AppData\Local\Temp\msvc-seed\55t0pf37.exe" msvc-burn
    3⤵
    PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\msvc-seed\ocfko1gi.exe
      "C:\Users\Admin\AppData\Local\Temp\msvc-seed\ocfko1gi.exe" msvc-burn
      4⤵
      PID:9268

C:\Users\Admin\AppData\Local\Temp\msvc-seed\f3dykqig.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\f3dykqig.exe"
1⤵
PID:8692

C:\Users\Admin\AppData\Local\Temp\msvc-seed\jc3zxcel.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\jc3zxcel.exe"
1⤵
PID:8716

C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjyci1p1.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\bjyci1p1.exe"
1⤵
PID:9028

C:\Users\Admin\AppData\Local\Temp\msvc-seed\fg793v4b.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\fg793v4b.exe"
1⤵
PID:8812

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:8080

C:\Users\Admin\AppData\Local\Temp\msvc-seed\c1s0b6dq.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\c1s0b6dq.exe"
1⤵
PID:3368

C:\Users\Admin\AppData\Local\Temp\msvc-seed\v0u9teu4.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\v0u9teu4.exe"
1⤵
PID:9416

C:\Users\Admin\AppData\Local\Temp\msvc-seed\nbscpbn5.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\nbscpbn5.exe"
1⤵
PID:9532

C:\Users\Admin\AppData\Local\Temp\msvc-seed\f27b7j7b.exe
"C:\Users\Admin\AppData\Local\Temp\msvc-seed\f27b7j7b.exe"
1⤵
PID:9684

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:9412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msvc.exe

Path C:\Users\Admin\AppData\Local\Temp\msvc.exe
Size 135KB
SHA256 92f6a872afe67814f0d2cc6958c7bf8110c056033842bd81c26bc228896dbe92
MD5 3bdf73de46052c86be6e7d73ac41f954
SHA1 365777571eca187c207cecb62514e24e9ad3bf37
SHA512 da4ec58f0326aa668b59d25c4788ba1030ee4120f44591bb7b047a5238323a1cdad0f7c365f6a9c9ee174d753b33a05c40217c0e726db5e9ed9f17dd72adf8ba
SSDEEP 3072:a/BqYxF3MmGZMIflvXaGQdwMGbInRSo7dRogehBIZtye4OD:a/BqYxF3MmGeKPvQD1RS2dJebepD
TLSH
T12ED32957B3E530F8E077C67AC8914941E773B8390B619BEF07A046665E236E09D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5540-428-0x00007FFED1520000-0x00007FFED154C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads