Resubmissions
28-12-2022 20:37
221228-zea5taef5v 1013-07-2021 12:27
210713-cvc55ag4yn 1025-02-2021 06:56
210225-dwftz9jkjn 1004-11-2019 11:15
191104-athqk1tjxn 10Analysis
-
max time kernel
135s -
max time network
121s -
resource
win7v191014 -
submitted
04-11-2019 11:15
Task
task1
Sample
update2.exe
Resource
win7v191014
0 signatures
General
-
Target
update2.exe
-
Size
746KB
-
MD5
0bfb4a1efbb20a7291fcc022dec7d58b
-
SHA1
faec2a0afe296224f980ac059cf63f18eba800ce
-
SHA256
73ae67036a0d291c18208037010de359520cd613dda2f9eabfde3fec5558324f
-
SHA512
eae0e585ef29f56f27da897783ec582b228124437a6355cfd7b56be229558913dfd87d3005482c0fe54ba8f5e79fb1d50f869bd0e619b0ca7318ac055c62b425
Malware Config
Extracted
Family
qakbot
Campaign
1572863946
Credentials
Protocol: ftp- Host:
192.185.5.208 - Port:
21 - Username:
[email protected] - Password:
NxdkxAp4dUsY
Protocol: ftp- Host:
162.241.218.118 - Port:
21 - Username:
[email protected] - Password:
EcOV0DyGVgVN
Protocol: ftp- Host:
69.89.31.139 - Port:
21 - Username:
[email protected] - Password:
fcR7OvyLrMW6!
Protocol: ftp- Host:
169.207.67.14 - Port:
21 - Username:
[email protected] - Password:
eQyicNLzzqPN
C2
112.171.126.153:443
67.200.146.98:2222
174.16.234.171:993
71.30.56.170:443
71.77.231.251:443
72.213.98.233:443
2.50.170.151:443
184.180.157.203:2222
96.35.170.82:2222
64.19.74.29:995
104.32.185.213:2222
104.3.91.20:995
173.22.120.11:2222
173.3.132.17:995
74.194.4.181:443
75.131.72.82:443
68.238.144.55:443
100.4.185.8:443
104.34.122.18:443
65.30.12.240:443
24.201.68.105:2087
32.208.1.239:443
168.245.228.71:443
47.153.115.154:995
24.201.68.105:2078
23.240.185.215:443
72.47.115.182:443
187.163.139.200:993
75.81.25.223:995
5.182.39.156:443
75.130.117.134:443
73.145.189.17:443
181.47.60.21:995
72.29.181.77:2083
81.147.42.195:2222
68.238.56.27:443
116.72.208.166:2222
78.94.55.26:50003
50.246.229.50:443
98.186.90.192:995
185.219.83.73:443
108.45.183.59:443
66.214.75.176:443
67.10.18.112:993
184.74.101.234:995
107.12.140.181:443
172.78.45.13:995
50.78.93.74:995
67.246.16.250:995
47.148.143.146:443
67.5.33.229:2078
47.23.101.26:993
12.5.37.3:995
24.30.71.200:443
72.29.181.77:2078
65.16.241.150:443
190.120.196.18:443
182.56.27.125:995
71.93.60.90:443
72.46.151.196:995
137.25.72.175:443
196.194.76.68:2222
76.116.128.81:443
105.246.75.20:995
197.89.140.129:995
62.0.67.88:995
190.217.1.149:443
188.52.115.139:443
47.180.66.10:443
107.12.131.249:443
75.142.59.167:443
181.94.163.26:443
98.186.155.8:443
61.98.155.61:443
47.202.98.230:443
2.50.41.185:443
217.162.149.212:443
75.110.90.155:443
166.62.180.194:2078
62.103.70.217:995
108.227.161.27:443
47.146.169.85:443
181.126.80.118:443
12.5.37.3:443
162.244.225.30:443
174.130.203.235:443
205.250.79.62:443
162.244.224.166:443
104.235.94.7:443
106.51.0.228:443
123.252.128.47:443
96.59.11.86:443
174.131.181.120:995
207.162.184.228:443
76.80.66.226:443
173.178.129.3:443
47.23.101.26:465
206.51.202.106:50002
201.152.111.120:995
75.131.72.82:995
174.48.72.160:443
75.70.218.193:443
12.176.32.146:443
68.174.15.223:443
199.126.92.231:995
173.178.129.3:990
72.16.212.107:995
200.104.249.67:443
207.179.194.91:443
75.110.250.89:443
108.160.123.244:443
50.247.230.33:443
47.214.144.253:443
99.228.242.183:995
72.142.106.198:465
73.226.220.56:443
45.37.57.119:2222
67.214.201.117:2222
173.247.186.90:443
98.148.177.77:443
111.125.70.30:2222
80.14.209.42:2222
2.177.101.143:443
67.160.63.127:443
70.185.229.3:443
184.191.62.78:443
47.155.19.205:443
88.111.255.235:2222
75.110.219.10:443
76.169.19.193:443
116.58.100.130:443
173.91.254.236:443
72.132.145.25:443
73.137.187.150:443
24.180.7.155:443
75.165.132.69:443
71.197.126.250:443
75.165.162.33:443
65.189.49.227:443
100.38.164.182:443
36.236.235.213:443
76.174.122.204:443
70.180.100.156:443
75.174.33.205:443
174.82.131.155:995
200.104.40.85:443
172.116.85.178:443
75.182.115.93:443
24.42.250.18:443
179.36.62.217:443
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
conhost.exepid process 1128 conhost.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet reg.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
update2.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ update2.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" update2.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" update2.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
update2.exeupdate2.exevanqawu.exevanqawu.exeexplorer.exeupdate2.exevanqawu.exevanqawu.exepid process 1300 update2.exe 1052 update2.exe 1052 update2.exe 1960 vanqawu.exe 1444 vanqawu.exe 1444 vanqawu.exe 732 explorer.exe 732 explorer.exe 1872 update2.exe 748 vanqawu.exe 1752 vanqawu.exe 1752 vanqawu.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg = "0" reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vanqawu.exepid process 1960 vanqawu.exe -
Executes dropped EXE 4 IoCs
Processes:
vanqawu.exevanqawu.exevanqawu.exevanqawu.exepid process 1960 vanqawu.exe 1444 vanqawu.exe 748 vanqawu.exe 1752 vanqawu.exe -
Turns off Windows Defender SpyNet reporting 6 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2" reg.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 101 IoCs
Processes:
update2.exevanqawu.exetaskeng.exeupdate2.exedescription pid process target process PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1052 1300 update2.exe update2.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1960 1300 update2.exe vanqawu.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1300 wrote to memory of 1484 1300 update2.exe schtasks.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 1444 1960 vanqawu.exe vanqawu.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 1960 wrote to memory of 732 1960 vanqawu.exe explorer.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 2024 wrote to memory of 1872 2024 taskeng.exe update2.exe PID 1872 wrote to memory of 832 1872 update2.exe reg.exe PID 1872 wrote to memory of 832 1872 update2.exe reg.exe PID 1872 wrote to memory of 832 1872 update2.exe reg.exe PID 1872 wrote to memory of 832 1872 update2.exe reg.exe PID 1872 wrote to memory of 1280 1872 update2.exe reg.exe PID 1872 wrote to memory of 1280 1872 update2.exe reg.exe PID 1872 wrote to memory of 1280 1872 update2.exe reg.exe PID 1872 wrote to memory of 1280 1872 update2.exe reg.exe PID 1872 wrote to memory of 1300 1872 update2.exe reg.exe PID 1872 wrote to memory of 1300 1872 update2.exe reg.exe PID 1872 wrote to memory of 1300 1872 update2.exe reg.exe PID 1872 wrote to memory of 1300 1872 update2.exe reg.exe PID 1872 wrote to memory of 552 1872 update2.exe reg.exe PID 1872 wrote to memory of 552 1872 update2.exe reg.exe PID 1872 wrote to memory of 552 1872 update2.exe reg.exe PID 1872 wrote to memory of 552 1872 update2.exe reg.exe PID 1872 wrote to memory of 1484 1872 update2.exe reg.exe PID 1872 wrote to memory of 1484 1872 update2.exe reg.exe PID 1872 wrote to memory of 1484 1872 update2.exe reg.exe PID 1872 wrote to memory of 1484 1872 update2.exe reg.exe PID 1872 wrote to memory of 736 1872 update2.exe reg.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000\Software\Microsoft\Windows\CurrentVersion\Run\vnctewgo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Igniwjmeevrg\\vanqawu.exe\"" explorer.exe -
Loads dropped DLL 18 IoCs
Processes:
update2.exevanqawu.exevanqawu.exeupdate2.exevanqawu.exevanqawu.exepid process 1300 update2.exe 1300 update2.exe 1960 vanqawu.exe 1960 vanqawu.exe 1960 vanqawu.exe 1960 vanqawu.exe 1444 vanqawu.exe 1444 vanqawu.exe 1444 vanqawu.exe 1872 update2.exe 1872 update2.exe 748 vanqawu.exe 748 vanqawu.exe 748 vanqawu.exe 748 vanqawu.exe 1752 vanqawu.exe 1752 vanqawu.exe 1752 vanqawu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\update2.exe"C:\Users\Admin\AppData\Local\Temp\update2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\update2.exeC:\Users\Admin\AppData\Local\Temp\update2.exe /C2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Loads dropped DLL
PID:1444
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
PID:732
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn anglvpjc /tr "\"C:\Users\Admin\AppData\Local\Temp\update2.exe\" /I anglvpjc" /SC ONCE /Z /ST 12:17 /ET 12:292⤵
- Creates scheduled task(s)
PID:1484
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2103240739-1537348966-412143755-334672013221329878-1302321046-1065545648-2100673529"1⤵PID:1856
-
C:\Windows\system32\taskeng.exetaskeng.exe {F6FF2302-9398-43C7-B9F4-9FA359A8EF38} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\update2.exeC:\Users\Admin\AppData\Local\Temp\update2.exe /I anglvpjc2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
PID:1872 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:832
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1280
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵PID:1300
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵PID:552
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1484
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:736
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"3⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1968
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"3⤵
- Windows security modification
- Turns off Windows Defender SpyNet reporting
PID:1020
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg" /d "0"3⤵
- Windows security bypass
PID:648
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exeC:\Users\Admin\AppData\Roaming\Microsoft\Igniwjmeevrg\vanqawu.exe /C4⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Loads dropped DLL
PID:1752
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\update2.exe"3⤵PID:1100
-
C:\Windows\system32\PING.EXEping.exe -n 6 127.0.0.14⤵
- Runs ping.exe
PID:1552
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /DELETE /F /TN anglvpjc3⤵PID:1536
-
-
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1295868263-1247198864-505262659480971325426345128-1808092798-1442865551-1670204134"1⤵PID:1520
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "184411764421144297691286979845169359115-19239216115322109331400112610223503404"1⤵PID:1088
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "392141117-677276710-667834401-194490010411243824091750595937-637753269-970863604"1⤵PID:316
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-230360005-291975559364168638483374989-9709165071723220528-1352204214-826407722"1⤵PID:1760
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "780431079529596972-12693982982109974750813785109-458066635-9242697291994244876"1⤵PID:1360
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "4626157107338769562356689-226338365144669281720427192281556809187-2062176847"1⤵PID:1516
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1599101780288898409-1598216450-917607549144048974114315380791266070695170864186"1⤵PID:1896
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2331403771744496171796223696-1419553858-444717163-1090966594-1356111542-756109536"1⤵PID:816
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "11373990-523956330169724034-4287605751507365334-116688865-1481536204344315635"1⤵PID:756
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "6592520761460298273673730342-1350623871152189836-6262277771429870143621846601"1⤵PID:1716
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2001977227-337384992-1140194078733047806-18860610632382570115842308621200406211"1⤵
- Suspicious use of SetWindowsHookEx
PID:1128