19efd754e6b8b96b507883b1b7d32d3565e347f80af0b2a7ab67bf04ccbcc645

Analysis

max time kernel
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_cbf8210e400dad5f13bee4340727021b_cobalt-strike_icedid_njrat_satacom.exe
Size 9.3MB
Sample261030-val93afa45
SHA256 19efd754e6b8b96b507883b1b7d32d3565e347f80af0b2a7ab67bf04ccbcc645
MD5 cbf8210e400dad5f13bee4340727021b
SHA1 8227efcf9b7a995a0b66bca417c3ac2793ccaa3e
SHA512 ebdc2768edabface34516a40ade57794d65bdcbe070188163a7db0d0e20d2f367e52192eef6eb33aa8e403a2d679ec08e7c59c3ca22e211790af869edb63508e
SSDEEP 49152:N+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T12FA62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe	2026-10-30_cbf8210e400dad5f13bee4340727021b_cobalt-strike_icedid_njrat_satacom.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\DWM\RuntimeBroker.exe	2026-10-30_cbf8210e400dad5f13bee4340727021b_cobalt-strike_icedid_njrat_satacom.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2912	svchost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 2912	5732	2026-10-30_cbf8210e400dad5f13bee4340727021b_cobalt-strike_icedid_njrat_satacom.exe	89
PID 2912 wrote to memory of 2752	2912	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-30_cbf8210e400dad5f13bee4340727021b_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_cbf8210e400dad5f13bee4340727021b_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Executes a file named after a Windows system binary
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe" -spawn 0 61 127 360 360
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe" -watchdog 2912 0 360 360
    3⤵
    PID:2752
- C:\Users\Admin\AppData\Local\Temp\DWM\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Temp\DWM\RuntimeBroker.exe" -spawn 1 274 680 360 360
  2⤵
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\DWM\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Local\Temp\DWM\RuntimeBroker.exe" -watchdog 4544 1 360 360
    3⤵
    PID:2572
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\sihost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\sihost.exe" -spawn 2 949 104 360 360
  2⤵
  PID:3296
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\sihost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\sihost.exe" -watchdog 3296 2 360 360
    3⤵
    PID:756
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ctfmon.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ctfmon.exe" -spawn 3 858 138 360 360
  2⤵
  PID:4616
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ctfmon.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ctfmon.exe" -watchdog 4616 3 360 360
    3⤵
    PID:2108
- C:\Users\Admin\AppData\Local\Temp\WindowsTelemetry\taskhostw.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsTelemetry\taskhostw.exe" -spawn 4 1142 684 360 360
  2⤵
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\WindowsTelemetry\taskhostw.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsTelemetry\taskhostw.exe" -watchdog 2828 4 360 360
    3⤵
    PID:5884
- C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
  "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -spawn 5 1165 285 360 360
  2⤵
  PID:4640
- - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
    "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4640 5 360 360
    3⤵
    PID:2392
  - - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
      "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 777 270 270
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5548 5 270 270
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 51 202 202
        6⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2396 5 202 202
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 707 151 151
        8⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2888 5 151 151
        9⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        10⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2632 5 140 140
        11⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        12⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5188 5 140 140
        13⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        14⤵
        
        PID:1008
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1008 5 140 140
        15⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        16⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5736 5 140 140
        17⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        18⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3372 5 140 140
        19⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        20⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        20⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        18⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3128 5 140 140
        19⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        20⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3132 5 140 140
        21⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        22⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5032 5 140 140
        23⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        24⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4304 5 140 140
        25⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        26⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3428 5 140 140
        27⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        28⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5228 5 140 140
        29⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        30⤵
        
        PID:8
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8 5 140 140
        31⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        32⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3660 5 140 140
        33⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        34⤵
        
        PID:712
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 712 5 140 140
        35⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        36⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        36⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        34⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3004 5 140 140
        35⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        32⤵
        
        PID:800
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 800 5 140 140
        33⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        30⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5364 5 140 140
        31⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        28⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3452 5 140 140
        29⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        26⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1852 5 140 140
        27⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        24⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4552 5 140 140
        25⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        26⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        26⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5004 5 140 140
        27⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        28⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        28⤵
        
        PID:240
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 240 5 140 140
        29⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        30⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        30⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2904 5 140 140
        31⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        32⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        32⤵
        
        PID:1280
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1280 5 140 140
        33⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        34⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5536 5 140 140
        35⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        34⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5964 5 140 140
        35⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        36⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3336 5 140 140
        37⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        38⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1588 5 140 140
        39⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        40⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5556 5 140 140
        41⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        42⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3332 5 140 140
        43⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        44⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5660 5 140 140
        45⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        46⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1636 5 140 140
        47⤵
        
        PID:832
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        48⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5776 5 140 140
        49⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        50⤵
        
        PID:860
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 860 5 140 140
        51⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        52⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        52⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        50⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1780 5 140 140
        51⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        52⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6260 5 140 140
        53⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        54⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6344 5 140 140
        55⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        56⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6456 5 140 140
        57⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        58⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6556 5 140 140
        59⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        60⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6676 5 140 140
        61⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        62⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6772 5 140 140
        63⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        64⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6888 5 140 140
        65⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        64⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6904 5 140 140
        65⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        66⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6988 5 140 140
        67⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        68⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7084 5 140 140
        69⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        70⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7068 5 140 140
        71⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        72⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7284 5 140 140
        73⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        74⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        74⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7772 5 140 140
        75⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        76⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5420 5 140 140
        77⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        78⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        78⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        76⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5812 5 140 140
        77⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        78⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        78⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5488 5 140 140
        79⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        80⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8532 5 140 140
        81⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        82⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8748 5 140 140
        83⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        84⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 9072 5 140 140
        85⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        86⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        86⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        84⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        82⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8836 5 140 140
        83⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        84⤵
        
        PID:2508
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2508 5 140 140
        85⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        84⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        80⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        72⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7300 5 140 140
        73⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        74⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4244 5 140 140
        75⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        76⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3392 5 140 140
        77⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        76⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7848 5 140 140
        77⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        78⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8300 5 140 140
        79⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        78⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8364 5 140 140
        79⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        80⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        80⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8672 5 140 140
        81⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        82⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 9140 5 140 140
        83⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        84⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6160 5 140 140
        85⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        84⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        82⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 9156 5 140 140
        83⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        84⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        84⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        74⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4704 5 140 140
        75⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        76⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        76⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        70⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3164 5 140 140
        71⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        72⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7324 5 140 140
        73⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        74⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        74⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        72⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7340 5 140 140
        73⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        68⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7104 5 140 140
        69⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        70⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6980 5 140 140
        71⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        72⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7364 5 140 140
        73⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        72⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7380 5 140 140
        73⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        70⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7060 5 140 140
        71⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
        72⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7404 5 140 140
        73⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        72⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7420 5 140 140
        73⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        66⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7004 5 140 140
        67⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        62⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6792 5 140 140
        63⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        60⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6692 5 140 140
        61⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        58⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6572 5 140 140
        59⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        56⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6472 5 140 140
        57⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        54⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6372 5 140 140
        55⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        52⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        48⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2288 5 140 140
        49⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        46⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5968 5 140 140
        47⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        44⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5452 5 140 140
        45⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        42⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5052 5 140 140
        43⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        40⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4600 5 140 140
        41⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        38⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3972 5 140 140
        39⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        36⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 2120 5 140 140
        37⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        22⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        20⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        16⤵
        
        PID:1776
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        14⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        12⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
        10⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1167 739 151 151
        8⤵
        
        PID:1520
      - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1320 542 202 202
        6⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 1980 5 202 202
        7⤵
        
        PID:2608
  - - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
      "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1524 340 270 270
      4⤵
      PID:4484
    - - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4484 5 270 270
        5⤵
        
        PID:3552
      - C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1320 542 202 202
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
        
        "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 5872 5 202 202
        7⤵
        
        PID:2140
- C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\explorer.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\explorer.exe" -spawn 6 501 527 360 360
  2⤵
  PID:5388
- - C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\explorer.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\explorer.exe" -watchdog 5388 6 360 360
    3⤵
    PID:1752
- C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\SecurityHealthSystray.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\SecurityHealthSystray.exe" -spawn 7 861 511 360 360
  2⤵
  PID:7880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\SecurityHealthSystray.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\SecurityHealthSystray.exe" -watchdog 7880 7 360 360
    3⤵
    PID:4464
- C:\Users\Admin\AppData\Local\Temp\WER\smartscreen.exe
  "C:\Users\Admin\AppData\Local\Temp\WER\smartscreen.exe" -spawn 8 1495 402 360 360
  2⤵
  PID:8268
- - C:\Users\Admin\AppData\Local\Temp\WER\smartscreen.exe
    "C:\Users\Admin\AppData\Local\Temp\WER\smartscreen.exe" -watchdog 8268 8 360 360
    3⤵
    PID:8324
- C:\Users\Admin\AppData\Local\Microsoft\Windows Defender\SystemSettings.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows Defender\SystemSettings.exe" -spawn 9 287 696 360 360
  2⤵
  PID:8964
- - C:\Users\Admin\AppData\Local\Microsoft\Windows Defender\SystemSettings.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows Defender\SystemSettings.exe" -watchdog 8964 9 360 360
    3⤵
    PID:3852

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
1⤵
PID:8952

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 9064 5 140 140
1⤵
PID:3068
- C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
  "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
  2⤵
  PID:8264
- C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
  "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
  2⤵
  PID:8668

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 8800 5 140 140
1⤵
PID:3476
- C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
  "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
  2⤵
  PID:7876
- C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
  "C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 1134 420 140 140
  2⤵
  PID:5060

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 6128 5 140 140
1⤵
PID:7760

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 3484 5 140 140
1⤵
PID:5576

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 4828 5 140 140
1⤵
PID:7872

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -watchdog 7516 5 140 140
1⤵
PID:4820

C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
"C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe" -clone 5 61 487 140 140
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dwm.exe

Path C:\Users\Admin\AppData\LocalLow\Microsoft\dwm.exe
Size 9.3MB
SHA256 69993539f28981bbc42f876b54a6dabc46b2f87b126d89545c1f83ba2b98e05d
MD5 5196c246852c6a6ee35e715193dabcd8
SHA1 a018964f2b781a18bea751fbd7b649b332af0df2
SHA512 527640556cb97bc7daa54b6cc0233e9ec383631d58d6246d56c392a1c42da2896f4a869bad2c8ad5d05338acf3ee7b6701dab556ecd887527f58217a4ed79260
SSDEEP 49152:V+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T193A62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\explorer.exe
Size 9.3MB
SHA256 0022db19a087486f2853e253a7c56a80a72afb9471f3eefb6f7c1869e387f9d9
MD5 98a8cfcb51e6a5ff92259cf2d632c34c
SHA1 3e6f8eb813871e5a6d3e6c5001a01cd55ce71e79
SHA512 e1de519302ed39a22a953f4b31ac812e0536d136075fe0f563975affff9eaace4d3e9ced715fcccba8f6effc1a02e958f00aea1ea67ef1e11dcb78d0453c4335
SSDEEP 49152:N+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T1E7A62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctfmon.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\ctfmon.exe
Size 9.3MB
SHA256 1cdf40c10b40f4e2e99501844e1f774a8238a899d8bed330cb35221e0e57c35a
MD5 f8a4a1036ce452a101a37e2275ecd872
SHA1 71e0ef5fee0a855dac76aea45a8e47ebda7b6f92
SHA512 44270f713776b8c5f32977ebac71844520020b3ae731bdfa7ad66462b8cbee4eb2b23bb9718af0e06f0eafe1a8d76a24aa98653ff4f04ea01bb74ffad5e83443
SSDEEP 49152:l+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T105A62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Apps\svchost.exe
Size 9.3MB
SHA256 f93f7f00cdff06c645eed18a21b3998dd0e66737b97aff6a2a18b6fd371494bc
MD5 8dbdad07e4fdb8c0d5d947df7e28a371
SHA1 b86f8f6adae3760e6b9875fe98fd279abc1e1da7
SHA512 dc48af78b92b1878014c02617a6adbf23d1e03572b5618011bcdf8aaefc133230706045ab40c36e28b855e2560cecb23130d52eb2080c020060563adf077b1fd
SSDEEP 49152:N+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T100A62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\DWM\RuntimeBroker.exe
Size 9.3MB
SHA256 f9ed369ffed2d88c3d16210e6c923a0c948d17879d5c1fe96a42ab750291f0f7
MD5 ad9e5ce1d693594b3aaca15048653494
SHA1 24249c3b9dd592083e14174313f76347b9849522
SHA512 8738d8a0ca31e89d49b2c037ab16419f7b486858789b83959e1582e4ac35cfc17dd8343a2f92d9592c2ab5a690c60447263652a14abb1acc7c562d066c4b7066
SSDEEP 49152:l+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T139A62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smartscreen.exe

Path C:\Users\Admin\AppData\Local\Temp\WER\smartscreen.exe
Size 9.3MB
SHA256 fab7e4ae81cda29c397291332cc984b4171d574e12da7f676c2e93a6fe2e0b30
MD5 5dc594cb81798bb910e2dac94a32eb4d
SHA1 78034f171e7b82e08eba8107d212990f1a9caf80
SHA512 491774d2bf0d41ffc3bab1f03c23e6f030dfba41a5a51675de7cc100fa8b2ad1bb53329eb84915017d518f8b54ed2f6c4251b68d0a81df2f11a87c010c63fa75
SSDEEP 49152:N+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T1EFA62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskhostw.exe

Path C:\Users\Admin\AppData\Local\Temp\WindowsTelemetry\taskhostw.exe
Size 9.3MB
SHA256 212e72e99c68693f712bbcef006e4547b1b262aa2c08df09790f64d7ff63dba8
MD5 7f9222f1a65a3e9d775904085d4eb635
SHA1 4de28832ed70adfaa4043f03bb53d57ab8caaa2d
SHA512 8f9a7008cd45dd2de569a621da11b879c3f58e1e020f9cc597e17cb98b21afd128296f19ee97c20e6679108f3fe728bb9c511a477f87c06bb5f6c00af945fd6a
SSDEEP 49152:l+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T1DAA62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthSystray.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\SecurityHealthSystray.exe
Size 9.3MB
SHA256 a10b02c7f502bd36bb583c090f2ec648ea1b6dec8550d44773c319285a5872f8
MD5 d26630ee2c718efada32866f8454343b
SHA1 0f976b0c4b8bfd97a33af52398bca60cbfba458e
SHA512 bb6060ea4c284804f77ae9c047b0d0a4901bc11421121fb0401a19b46c7c6aaa43b788f2673291ce3ff6578e36473669ace993ca978e635f5612158fd48279f8
SSDEEP 49152:V+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T149A62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sihost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\sihost.exe
Size 9.3MB
SHA256 316871a298713979a10d5375e9b909abc937574bdbe1224f7190ebcd01eb1036
MD5 6a556d8c82ac80ca7407dc05cefab681
SHA1 855533461d7db7897bdcc0172570435a551c734d
SHA512 12e76cf3dc673a691bf69dd0156defd4a7f63af4dc7b289a906a0947694368d5699ce1f23170045d5ab3df46a840c2934b3b80b8b0f157efda50a619edb81098
SSDEEP 49152:N+/nu/dyAqJRu/MX9TE75iXGbigetSubiqDfS7eUj//yHaK4bcMgdWQYZDAAWeuM:
TLSH
T10CA62330AF933FEFD7640A7840791D875F6C9D8B8326E1C9828476D265A6A14CFCDA70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-359-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/1520-311-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/1720-90-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/1776-362-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/1776-385-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/1776-375-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/2336-360-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/2336-373-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/2448-334-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/2560-394-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/2632-312-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3128-387-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3128-377-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3128-364-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3132-367-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3276-313-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3372-363-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3372-386-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3372-376-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3572-388-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3572-365-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/3572-378-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/4160-366-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/4160-379-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/4484-353-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/4640-351-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/4640-343-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/5548-352-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/5704-358-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/5736-374-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/5736-384-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/5736-361-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/7516-335-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/7548-316-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/7556-317-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/7564-318-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

memory/7712-408-0x00007FF6ABF20000-0x00007FF6AC868000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads